McDonnell Douglas DC-10
The DC-10 was a wide-body trijet designed for medium-to-long-range routes, featuring a distinctive tail-mounted center engine. While it became a backbone of global logistics and passenger travel, its early service history was marked by high-profile accidents related to cargo door design and hydraulic system redundancy.
Fleet Safety Record
0Passenger operations ceased in 2014; limited freighter and tanker (KC-10) variants remain in specialized use.
In BlackBoxWiki Archive
Cargo Door Design and Explosive Decompression
Early DC-10 models utilized an outward-opening cargo door designed to maximize internal volume. Unlike inward-opening 'plug' doors, this design relied entirely on a locking mechanism to resist pressurization loads. A design flaw in the latching system allowed the door to appear locked when the locking pins were not fully engaged. This led to catastrophic explosive decompressions, most notably in the Windsor and Ermenonville incidents, which resulted in the collapse of the cabin floor and the severing of critical control cables routed beneath it.
Hydraulic System Vulnerabilities
The DC-10 featured three independent hydraulic systems, but they were routed in close proximity through the leading edges of the wings and the tail section. In the event of a major structural failure, such as an uncontained engine failure or a catastrophic pylon separation, all three systems could be breached simultaneously. The lack of hydraulic fuses or shut-off valves in early configurations meant that a single point of impact could result in a total loss of flight control surfaces.
Engine Pylon Maintenance Procedures
The 1979 American Airlines Flight 191 crash highlighted a vulnerability not in the aircraft's design, but in its sensitivity to non-standard maintenance. To save time, mechanics used a forklift to remove the engine and pylon as a single unit, a procedure not authorized by McDonnell Douglas. This induced hairline fractures in the pylon attachment points, leading to engine separation during takeoff, which subsequently damaged hydraulic lines and retracted the left-wing outboard slats, causing an asymmetrical stall.
Notable Accidents
- American Airlines Flight 96· 1972Cargo door failure over Windsor, Ontario; successful emergency landing revealed design flaw.
- Turkish Airlines Flight 981· 1974Catastrophic cargo door failure and floor collapse near Ermenonville; 346 fatalities.
- American Airlines Flight 191· 1979Engine separation due to improper maintenance pylon damage; led to temporary grounding of the US fleet.
- Air New Zealand Flight 901· 1979Controlled flight into terrain (CFIT) in Antarctica due to navigation coordinate errors.
- United Airlines Flight 232· 1989Uncontained fan disk failure in engine #2 severed all three hydraulic systems; demonstrated need for hydraulic fuses.
Recurring Causal Patterns
- Mechanical failure of outward-opening cargo door latches
- Total loss of hydraulic redundancy due to co-located routing
- Structural sensitivity to improper pylon maintenance procedures
- Asymmetric slat retraction following hydraulic fluid loss
Regulatory & Industry Response
- FAA Airworthiness Directive mandating redesign of cargo door locking pins and vent flaps
- Requirement for steel plating to protect hydraulic lines in the tail section
- Installation of hydraulic fuses to isolate fluid loss in the event of structural damage
- Temporary suspension of the DC-10 Type Certificate in 1979
Verdict
The DC-10's safety record was significantly compromised by early design choices regarding cargo door security and hydraulic routing. While subsequent engineering retrofits and the introduction of the MD-11 addressed these vulnerabilities, the type's reputation was permanently affected by high-fatality events linked to these specific failure modes.