DC-10 Problems Whose Responsibility?

Glenn C. Graber Christopher D. Pionke

Philosophy Mechanical, Aerospace & Biomedical Engineering

1974 Paris DC-10 Ship 29

Turkish Airlines 346 passengers 10,000 feet Cargo door failed, floor of passenger compartment collapsed All hydraulic & electrical connections were severed Airplane uncontrollable Plane crashed All aboard were killed

What Went Wrong?

Who is Responsible?

Design Process
In designing the airframe, McDonnell-Douglas chose to make the DC-10 much like the older DC-8 and DC-9, two very successful and safe aircraft.
PRO: sped up design process;
fitted an oft-stated company policy of technological caution

technological caution
Quotes from McDonnell-Douglas company literature expressing this aspect of corporate culture:
Be not the first by whom the new are tried / Nor yet the last to lay the old aside. (Alexander Pope) Pioneering dont pay. (Andrew Carnegie)

CON: question as to whether same principles apply to wide-body aircraft

More Info About Process

The DC-10 engineers were constrained by management to use the existing airframe technology (which was not necessarily adequate for an aircraft the size of the DC-10) Both Boeing and Lockheed had made several advancements in their airframe structural designs for the 747 and the L-1011, respectively. These design advances were not proprietary So one might argue that the accepted engineering practice for building a jumbo jet was significantly different from what McDonnellDouglas was doing. (Fledderman, 76)

Another opinion:
There are a few points on which most experts agree, however:
the DC-10 is fully airworthy in the sense that it meets all federal standards for airworthiness; from a statistical point of view, it has been, like the other jet-powered aircraft, a very safe airplane; . . . and the airlines that operate DC-10s appear satisfied that it does the job for which it was intended (Newhouse, 2, p.84)

Airworthiness
If in inspecting an airplane, the F.A.A. sees a need to repair or modify something, it issues what is called an airworthiness directive. Once issued, such a directive has the force of law. (Newhouse, 2, p. 84)
As of May 25, 1982, McDonnell-Douglas was well ahead:

Cargo-Door Latching System

3 choices: Plug design / Hydraulic / Electric
Plug (DC-9) infeasible for larger door Electric
Lighter, fewer parts, easier to maintain Exerts pressure only when switched on; irreversible If it fails to close completely, it holds more securely but more catastrophic failure sudden depressurization at high altitude Heavier, more parts, harder to maintain Continually exerts pressure; not irreversible If it fails to close completely, more frequent failures but less catastrophic failures less violent depressurization at much lower altitude

DC-10 L-1011 747

83 directives 58 directives 56 directives

Hydraulic

In most ways that matter to airlines, the DC-10 is similar and does not compare unfavorably with the other wide-bodies.

Cargo-Door Latching System

McDonnell-Douglas went with the electrical system
Failure less likely More catastrophic if it does fail

Passenger Floor Supports

Followed DC-9 format for number of floor supports. In retrospect, this was relatively few floor supports given the wide-bodied nature of the plane. WHY? The principle of technological caution, together with severe financial straits of the company was apparently interpreted by its engineers to dictate that corners be cut and existing Douglas technology be used, even if it meant that some systems that were rejected as inferior by its competitors would be designed into the DC-10. (French, 6)

Redundancies

of hydraulic & electrical systems

DC-10: 3 redundant systems

Both competitors had 4 systems How many redundancies becomes a waste?

Location of systems
DC-10: all 3 systems ran in parallel under the cabin floor Boeing: control lines run through the ceiling above the cabin

FMEA Report

(Failure Mode and Effects Analysis)

One of nine possible failure sequences that could result in life endangering hazards:
Door will close and latch, but will not safety lock. Indicator light will indicate normal position. Door will open in flight-resulting in sudden depressurization and possibly structural failure of floor; also damage to empennage by expelled cargo and/or detached door. Class IV hazard in flight.
Class IV hazard = possible loss of life empennage = tail assembly

Ship 1 (1970)
the prototype ship was undergoing standard pressurization tests on the ground outside Long Beach plant
The cargo door blew and The cabin floor collapsed

This report was never submitted to the FAA

1972 Windsor, Ontario

Cargo door failed in flight Floor of passenger cabin buckled Several (but not all) of the hydraulic lines were severed Pilot maintained control of plane and landed safely

Remediation (?) after Windsor

Agreement reached with FAA for modification of cargo doors July 1972 Ship 29 to Long Beach
The plant records for July 1972 indicate that three inspectors stamped the work records for Ship 29 to indicate the modifications had been completed and that the plane was in compliance with FAA guidelines.

None of the work had actually been done

Stated Company Policy

You are responsible for any work that your stamp appears on record for accepting.

Actual Company Practice

One of the inspectors explained the presence of his stamp by saying it was high summer and he probably became confused. The other 2 offered no explanation at all. Corporate executives rushed to deny any responsibility for seeing that the work was actually done

Frenchs Analysis:
the McDonnell-Douglas system . . . Is fundamentally weak and easily compromised by employees who have fallen into a rather automatic pattern of behavior encouraged by that company policy and procedure. (French, 9) The evidence supports the view that over the years McDonnell-Douglas established an inspection procedure that invites or tempts inspectors to be lax and careless and some of the inspectors, either through inadvertence or because of conditioning to laxness, cursorily performed tasks that, given the basically poor design of the aircraft, called for the closest attention to detail to insure safety. (French, 9)

Whos to blame? French says:

The actions of the three inspectors are not excusable . . . but it would be a grand offense to our moral intuitions . . . to hold these inspectors primarily responsible for the crash of Ship 29. We are brought back to the principal actor in the design, manufacture, and sale of Ship 29, McDonnell-Douglas Corporation. (French, 10)

Corporate, not Individual Responsibility

Two Speculative Scenarios:

1. invites or tempts Inspectors hear management complain frequently about government mandates, expressing the view that the modifications ordered are meaningless and make no difference with regard to safety. 2. The companys financial straits leads to cutting several personnel lines for inspectors. Those remaining are given heavier workloads than they can possibly carry out. When they complain, they are told Do the best you can.

Bibliography
Peter French, What is Hamlet to McDonnell-Douglas or McDonnell-Douglas to Hamlet? Business & Professional Ethics Journal vol. 1, no. 2 (1982), pp. 1-13. Daniel A. Vallero, and P. Aarne Vesilind. Socially Responsible Engineering Justice in Risk Management. (Hoboken, NJ John Wiley & Sons, 2007), pp. 66-71. Charles B. Fleddermann. Engineering Ethics. (Upper Saddle River, NJ Prentice Hall, 1999).

Bibliography (2)
John Newhouse, A Reporter at Large: A Sporty Game, The New Yorker
1. Betting the Company June 14, 1982 (pp. 48-105) 2. Turbulent June 21, 1982 (pp. 4693) 3. Big, Bigger, Jumbo June 28, 1982 (pp. 45-86) 4. A Hole in the Market July 5, 1982 (pp. 44-89)

Webography
Applying Lessons Learned from Accidents: Turk Hava Flight TK981, DC-10, Paris
http://faalessons.workforceconnect.org/l2/Turk/

Aviation Safety Network

http://aviation-safety.net/database/type/type.php?type=352