Question 1: (The FAA's final action was sufficient to prevent future accidents involving the potential to lose all hydraulics and still be able to prevent a crash. Note: This includes different scenarios that might lead to the situation of no hydraulics.

True or False? )

B.2 The DC-10 Cargo Door Saga One of the worst accidents in aviation history occurred near Paris in March 1974, when a Turkish Airlines DC-10 crashed, resulting in 346 deaths. A very detailed account of this accident and its precursors can be found in Eddy, Potter and Page [1976]. B.2.1 Background During much of an airplane's flight regime, the air pressure outside is significantly less than that inside the cabin, resulting in a high-pressure differential. Structural failure of the cabin hull, therefore, can lead to explosive decompression. The door design is particularly critical as the doors represent a potential weak point in the structural integrity of the plane. The DC-10 was designed such that the flight controls for the number-2 engine, the elevators, the mechanically controlled trim, and the rudder are routed under the cabin floor, which has considerably less strength than the external parts of the airframe. If the cargo hold becomes depressurized, the higher pressure in the passenger compartment above can cause the cabin floor to collapse, potentially severing the flight control cables. B.2.2 Events In 1968, while the DC-10 was still being designed, engineers from Rijksluchtvaartdienst (RLD), the Dutch equivalent of the FAA, issued repeated warnings about the integrity of the passenger compartment floors in jumbo jets. In the same year, American Airlines asked Douglas to change the hydraulic actuators for closing the cargo doors on the DC-10 to electrical ones. The Douglas engineers had proposed hydraulic actuators because they were highly familiar with this technology and so were their subcontractors. The American Airlines engineers, however, thought that a hydraulically operated door would have too many working parts, and electrically operated actuators would be lighter and thus save money in fuel costs. Because the electric actuators would have fewer parts, the door would also be easier to maintain. Douglas agreed to the American Airlines request. In 1969, Douglas asked Convair, the firm developing the fuselage of the plane under a subcontract, to draft a failure modes and effects analysis (FMEA) for the lower cargo door system. Convair found nine potential failure sequences that could lead to a Class IV hazard (defined as involving danger to life); four failure modes involved explosive decompression in flight. The exact problem that eventually led to the accidents was not identified by the FMEA, but the analysis did demonstrate the danger of the door design without a totally reliable fail-safe locking system: A scenario very similar to what actually happened later in the Windsor and Paris accidents was identified. According to the FMEA, little reliance was to be given to warning lights on the flight deck because "failures in the indicator circuit, which result in incorrect indication of door locked and/or closed, may not be discovered during the checkout prior to takeoff" (quoted in Eddy et.al 1976]. Convair also concluded that even less reliance should be placed on warning systems that depended on the alertness of ground crews. Before FAA certification, manufacturers were required to provide a FMEA for those systems critical to safety. However, the DC-10 FMEAs submitted by Douglas to the FAA did not include any mention of the possibility of a Class IV hazard related to a malfunction of the lower cargo doors. The RLD concern continued, and they explicitly warned about the cargo-door danger at an ICAO (International Civil Aviation Organization) meeting in Montreal. In 1970, a prototype DC-10 was unveiled, and on May 29, the passenger floor did collapse after the cargo door blew out during a static ground test of the air conditioning system. The test involved building up a pressure differential of four to five pounds per square inch, which caused a large section of the cabin floor to collapse into the hold. The Douglas response to this event was similar to their response to later eventsthey blamed it on an error by the mechanic who was responsible for closing the door. They did, however, modify the door to add what they assumed were extra safeguards. In fact, the new vent door system contributed little or no extra safety [Eddy et.al 1976]. In 1971, the aircraft was certified despite reports of problems with the rear cargo door and the floor collapse during test. The RLD complained directly to Douglas about the design when KLM decided to buy the plane, but no changes were made. The FAA was not informed about these discussions. After the plane became operational, the warnings about the cargo-door design turned out to be correct. There were 11 entries in maintenance logs up to June 1972 concerning difficulties with locking the door. Then, on June 12, 1972, an American Airlines DC-10 lost part of its passenger floor when a cargo door failed over Windsor, Ontario. Catastrophe was averted only by the extraordinary poise and skill of the pilot, Bryce McCormick. He had trained himself to fly the plane using only the engines because he was concerned about a decompression-caused loss of the control cables. McCormick was a conservative pilot and had been worried from the beginning about the absence of any mechanical way to operate the control surfaces on the DC-10. In most smaller jets at the time, there was a manual backup system to operate the flaps, rudder, and elevator if the hydraulic systems should fail. The jumbo jets, however, relied on hydraulics without a manual backup. To prepare himself for an emergency, McCormick experimented with a DC-10 simulator in Texas. He figured out what would happen in the event of total hydraulic failure and how to fly the DC-10 using differential engine power to steer. By chance, McCormick was the pilot when this emergency first occurred. The hydraulic lines survived the explosive decompression and partial floor collapse, but the wire cables that send signals from the cockpit to the tail were severed or jammed. McCormick was able to land the plane, using the differential engine power technique he had devised in the simulator. After his near catastrophe, McCormick recommended that every DC-10 pilot be informed of the consequences of explosive decompression and trained in the flying techniques that he and his crew had used to save their passengers and plane. McDonnell-Douglas never did this. Instead, they attributed the Windsor incident to an error by the baggage handler and not to any error on the part of their designers and engineers. McDonnell-Douglas decided that all they had to do was to come up with a fix that would prevent baggage handlers from forcing the door. One of the discoveries after this accident was that the door could be improperly closed, but the external signs, such as the position of the external handle, made it appear to be closed properly. In addition, this incident proved that the cockpit warning system could fail, and the crew would then not know that they were taking off without a properly closed door. The aviation industry does not normally receive such manifest warnings of basic design flaws in an aircraft without cost to human life. Windsor deserved to be celebrated as an exceptional case when every life was saved through a combination of crew skill and the sheer luck that the plane was so lightly loaded. If there had been more passengers and thus more weight, damage to the control cables would undoubtedly have been more severe, and it is highly questionable if any amount of skill could have saved the plane [Eddy et.al 1976]. The regional branch of the FAA, headed by a man named Basnight, started to investigate the Windsor incident and asked the Douglas company if there had been any previous problems with DC-10 cargo doors. The company admitted only that there had been a few "minor problems," but did not provide the operating reports filed by the airlines using DC-10s. A highly experienced test pilot, Dick Sliff, who worked for Basnight, knew that airplane systems usually give some warning before they fail. He was disturbed by Douglas' attitude and "raised a fuss" to get the airline reports [Eddy et.al 1976]. Examining the records, Sliff found that there had been about one hundred reports of the door failing to close properly during the ten months of DC-10 service and that Douglas had already recommended modifications to the system. The National Transportation Safety Board recommended that the FAA issue an Airworthiness Directive requiring (1) the redesign of the door so that it was physically impossible for the door to be improperly closed and (2) the modification and strengthening of the cabin floor to prevent its collapse after a sudden decompression. The FAA Western Regional Office, under Basnight's supervision, wrote a draft Airworthiness Directive for the problem, but it was never issued. Instead, a nonmandatory agreement was made between Douglas and the head of the FAA, which later became known as the Gentleman's Agreement, simply to add a metal plate rather than redesign the door to eliminate the hazard. Basnight wrote a memo expressing his outrage at this arrangement. Fifteen days after the Windsor incident, the senior Convair engineer directing the DC-10 fuselage development, Dan Applegate, wrote and filed away his own memo expressing his shock and dismay at the agreement (quotations from this latter memo can be found in Chapter 4). Applegate's memo, directed to the vice president of Convair, detailed the ways that cargo doors could open during flight, the history of the cargo door design changes, and the inevitability of future accidents unless the door design was changed and the cabin floor was strengthened. In their response to Applegate, Convair management denied neither the technical assessment nor the predictions, but argued that the potential Convair financial liabilities involved in grounding the plane (which would be high and would place McDonnell-Douglas at a competitive disadvantage) prohibited them from passing on the contents of the Applegate memo to McDonnell-Douglas [Newhouse 1982]. Applegate was told by his management that no additional effort would be made to correct the problem. The FAA was never notified about this memo; in fact, under Convair's contract with McDonnell-Douglas, Convair was prohibited from contacting the FAA directly about the issue [Kipnis 1981]. The plate added to the door might have been sufficient, but first it had to be added. There were 39 DC-10s in service when Douglas proposed the changes. Five planes were modified within 90 days, 18 were not modified until 1973, and one not until a year and a half after the bulletin was issued. In Long Beach, the required changes also were not made to some new aircraft still at the factory, including one destined for Turkish Airlines (THY), but this omission was not discovered until later. After the Windsor incident, in September 1972, the Dutch RLD again sent a delegation to Los Angeles, this time to meet with both the FAA and McDonnell-Douglas in order to discuss their concerns about the DC-10 design. McDonnell-Douglas took the position that the DC-10 floor met all of the FAA air worthiness directives. The RLD replied that the directives were inadequate. In a formal reply to the RLD, the FAA said, "We do not concur with RLD views concerning the inadequacy of FAA requirements" [Eddy et.al 1976]. The RLD certified the DC-10, but placed on record their reluctance in doing so. By February 1973, the FAA had changed their minds and decided that something needed to be done about jumbo jet floors. McDonnell-Douglas insisted that the chances of a cargo door opening in flight were "extremely remote" and that a reassessment of the DC-10 design showed that the current standard was adequate. In 1973, DC-10 number 29 was delivered to Turkish Airlines, whose ground crews were presumably trained in all aspects of the maintenance of the aircraft. Records hint that this was not necessarily the case, perhaps because of national pride or attempts by Turkish Airlines to limit expenses [Sawyier 1984]. On the day of the crash, a strike in London grounded all British European Airways (BEA) flights. Demand for flights to London was high because a rugby match had just been played in Paris, and the Turkish Airlines plane filled quickly. Many flights had to be canceled because of the strike, but the Turkish plane could get out if they hurried, and the departure was rushed. Ground support for Turkish Airlines aircraft at Orly was sublet to a private company called SAMOR. The person doing the work was a 39-year-old Algerian immigrant named Mahmoudi, who had worked for SAMOR since 1968. He was not familiar with this version of the DC-10 cargo door, but was given instructions about how to close the door and told that if for any reason the latches did not go home, the locking handle would encounter resistance and the vent door would refuse to close. He was warned against trying to force the handle. However, for various controversial reasons, the locking pins in the door had been adjusted so that only 13 pounds of pressure was required to operate the locking handle successfully and to close the vent door even if the latches were actually only partially closed. Instructions for locking the door were printed in English next to it, but although Mahmoudi spoke several languages, English was not one of them. The procedure was complicated and difficult. When he closed the door, the handle appeared to seat and the vent door to close. The final check on the door was not Mahmoudi's job. SAMOR's contract said that the airline was responsible for ensuring that every plane was safe before it took off, and someone from Turkish Airlines was supposed to check the cargo door peephole. Usually this task was done by Osman Zeytin, the Turkish Airlines' head mechanic at Orly, but he was away on vacation. Sometimes Turkish Airlines flight engineers would leave the cockpit to peer through the peepholes, and there was also a Turkish Airlines ground mechanic, Hasan Engin Uzok, on board the DC-10. None of the airport workers saw him or the flight engineer check the door. A safety device, added by McDonnell-Douglas after the failure of the cabin floor during the air conditioning tests, should not have allowed the cabin to be pressurized when the door was not properly locked. Apparently, this device did not work, as it also had not in the 1972 Windsor accident. An annunciator light on the flight engineer's panel should have warned that the cargo door was not properly closed. The light was designed to remain on until the cargo door had been fully closed, but when Mahmoudi pulled the locking handle down, the light in the cockpit went off. There have been allegations that the light had been tampered with, perhaps to make maintenance easier. The Turkish Airlines plane took off carrying 353 passengers, 11 crew members, and a full cargo compartment. It climbed to 13,000 feetapproximately the same altitude as the Windsor accidentand headed for London. Eight minutes later, the cargo door blew out and the cabin floor buckled. Six passengers, still in their seats, were sucked down and out of the plane. The control cables to the rudder and stabilizer were severed, and the pilots could not recover. If the plane had not been so full and thus had less pressure been on the floor, enough of the controls might have survived the floor collapse to avoid the accident. After the crash, Sanford McDonnell expressed the McDonnell-Douglas position by placing the blame on Mahmoudi, whom he called an "illiterate" baggage handlerand the other ground personnel, just as the company had blamed the Windsor accident on the baggage handler and the test failure on the mechanic. Later, the company shifted the blame to Convair and Turkish Airlines, both of which it accused of negligence [Eddy et.al, 1976]. An FAA investigation showed that the cargo door support plate, stipulated in the Gentleman's Agreement, was never added to the door of the Turkish Airlines DC-10 (number 29) in the factory before being delivered. Laker Airlines also found that the modification was missing on two planes it received after the change was agreed upon. The president of Douglas Aircraft claimed that the records showed that the factory modifications had been made, and the aircraft was stamped by its inspectors as having been modified. The inspectors were questioned under oath after the accident, and none could recall having worked on the cargo door of any DC-10 at any time during 1972 nor could they recall any occasion on which they had worked together. They were certain they had not inspected the doors of number 29 on July 18, as the records showed, and had no idea how their stamps could have gotten on the maintenance records. McDonnell-Douglas' position was that the falsification of manufacturing records was an isolated and totally mysterious failure in an otherwise excellent system [Eddy et.al 1976]. The FAA also discovered, after an examination of the records of every U.S. airline that owned DC-10s for the six-month period between October 1973 and March 1974, that there had been 1,000 cargo-door incidents in less than 100 DC-10s---an average of more than ten cargo door incidents for every DC-10 operating in the United States. Airlines routinely submit these maintenance reliability reports to the manufacturers [Eddy et.al 1976]. The FAA finally ordered modifications on all DC-10s that eliminated the hazard and made mandatory the modifications that were supposed to have been made 20 months before. In addition, an FAA regulation introduced in July 1975 required all wide-bodied jet floors to be able to tolerate a hole in the fuselage of 20 square feet.

Read the following article as well: https://www.popularmechanics.com/flight/a10478/the-final-flight-of-united-232-16755928/