McDonnell Douglas DC-10
The DC-10 was a wide-body trijet designed for medium-to-long-range routes, featuring a distinctive tail-mounted center engine. While it became a backbone of global logistics and passenger travel, its early service history was marked by high-profile accidents related to cargo door design and hydraulic system redundancy.
Sources and editorial review
Awaiting editorial verification · Legacy analysis. Archive counts describe this collection; they are not aircraft safety rates.
Fleet totals are withheld until their sources have been reviewed.
In BlackBoxWiki Archive
Figures count recorded events, including incidents. Multi-aircraft events can appear under more than one aircraft family; casualty totals describe the whole event.
Cargo Door Design and Explosive Decompression
Early DC-10 models utilized an outward-opening cargo door designed to maximize internal volume. Unlike inward-opening 'plug' doors, this design relied entirely on a locking mechanism to resist pressurization loads. A design flaw in the latching system allowed the door to appear locked when the locking pins were not fully engaged. This led to catastrophic explosive decompressions, most notably in the Windsor and Ermenonville incidents, which resulted in the collapse of the cabin floor and the severing of critical control cables routed beneath it.
Hydraulic System Vulnerabilities
The DC-10 featured three independent hydraulic systems, but they were routed in close proximity through the leading edges of the wings and the tail section. In the event of a major structural failure, such as an uncontained engine failure or a catastrophic pylon separation, all three systems could be breached simultaneously. The lack of hydraulic fuses or shut-off valves in early configurations meant that a single point of impact could result in a total loss of flight control surfaces.
Engine Pylon Maintenance Procedures
The 1979 American Airlines Flight 191 crash highlighted a vulnerability not in the aircraft's design, but in its sensitivity to non-standard maintenance. To save time, mechanics used a forklift to remove the engine and pylon as a single unit, a procedure not authorized by McDonnell Douglas. This induced hairline fractures in the pylon attachment points, leading to engine separation during takeoff, which subsequently damaged hydraulic lines and retracted the left-wing outboard slats, causing an asymmetrical stall.
Notable Accidents
- American Airlines Flight 96· 1972Cargo door failure over Windsor, Ontario; successful emergency landing revealed design flaw.
- Turkish Airlines Flight 981· 1974Catastrophic cargo door failure and floor collapse near Ermenonville; 346 fatalities.
- American Airlines Flight 191· 1979Engine separation due to improper maintenance pylon damage; led to temporary grounding of the US fleet.
- Air New Zealand Flight 901· 1979Controlled flight into terrain (CFIT) in Antarctica due to navigation coordinate errors.
- United Airlines Flight 232· 1989Uncontained fan disk failure in engine #2 severed all three hydraulic systems; demonstrated need for hydraulic fuses.
Recurring Causal Patterns
- Mechanical failure of outward-opening cargo door latches
- Total loss of hydraulic redundancy due to co-located routing
- Structural sensitivity to improper pylon maintenance procedures
- Asymmetric slat retraction following hydraulic fluid loss
Regulatory & Industry Response
- FAA Airworthiness Directive mandating redesign of cargo door locking pins and vent flaps
- Requirement for steel plating to protect hydraulic lines in the tail section
- Installation of hydraulic fuses to isolate fluid loss in the event of structural damage
- Temporary suspension of the DC-10 Type Certificate in 1979
Top Causes in Archive
Case Files in Archive (23)
Verdict
The DC-10's safety record was significantly compromised by early design choices regarding cargo door security and hydraulic routing. While subsequent engineering retrofits and the introduction of the MD-11 addressed these vulnerabilities, the type's reputation was permanently affected by high-fatality events linked to these specific failure modes.