DC-10

History

The DC-10 program was launched by McDonnell Douglas in 1968, after a request from longtime Douglas customer American Airlines to create a widebody aircraft for shorter routes not requiring the capacity of the Boeing 747. McD was in competition with Lockheed, which was developing the Lockheed Tristar at the same time to fulfill the same request.

Both Lockheed and McD's aircraft were almost identical: three-engined jetliners with a capacity of around 250, except for one very important feature. On the DC-10, the third engine was mounted on the tail fin. On the Tristar, the third engine was mounted at the rear end of the fuselage, and air was brought in to the turbofan by an S-shaped duct leading to an intake at the front of the tail fin.

     ___                 ___
    /   |               /   |
 __/____|_             /    |
|________/::::    ____/     |
_/______|__     _|_______   |__
          /                   /::::
   DC10               L1011

By the time the DC-10 made its first flight in 1970, three months ahead of Lockheed, American had already decided to go with McD's aircraft, ordering fifty. It already looked like the DC-10 was going to defeat Lockheed's entry in every way.

Problems

However, the first models of the DC-10 had a serious defect in their aft cargo doors: the locking pins on the doors weren't long enough to adequately secure them. On June 12, 1972, one of American's DC-10's, operating as American Airlines flight 96, lost its cargo door shortly after taking off from Detroit: the cabin lost its pressurization and the hydraulics failed, leaving the pilots unable to steer the airplane. Fortunately, they were able to land the plane solely with its three throttles: a unique capability made possible by the DC-10's engine layout. McD promptly issued a warning to airlines to change the locking mechanisms on their cargo doors.

Many overseas carriers didn't listen to this warning: one, Turkish Airlines, paid for it with the loss of 346 lives after one of their aircraft, Turkish Airlines flight 981, went down outside of Paris on March 3, 1974.

Things went smoothly for the DC-10 program over the next five years, before all hell broke loose again. On May 25, 1979, American Airlines flight 191 lost one of its engines and crashed after takeoff from O'Hare, killing all 272 people on board. Three days later, every DC-10 in the United States was grounded while the National Transportation Safety Board checked the problem out. The problem: weak pylon design, which made it easier for engines to fall off if they were mishandled during overhaul procedures. The problem was fixed, and the DC-10's returned to the sky again.

Then came the July 19, 1989 crash of United Airlines flight 232 in Sioux City, Iowa. In midair, the aircraft's tail engine exploded, again killing every hydraulic system on the aircraft, and this time leaving the captain with only two engines to fly with. However, the Sioux City crash was almost a testament to the DC-10 rather than a damnation: even with only two engines, the captain was able to bring the aircraft from cruising altitude down to the runway, only losing control at the last minute and plowing into the ground. Most of the passengers on board survived. The DC-10 was, in many ways, vindicated.

The last production DC-10 was delivered in 1990, and the aircraft was phased out in favor of its newer version, the MD-11.

Versions

DC-10-10: The original variant of the DC-10 first flew in 1970.

DC-10-15: Introduced in 1979. It was a DC-10-10 with the high-powered engines from the DC-10-30. It was dubbed the "DC-10 Sport" and purchased by Aeromexico and Mexicana for use from high-altitude airports in the mountains of Latin America. Seven were built.

DC-10-20: Introduced shortly after the DC-10-10 model, from a request from Northwest Airlines for a longer-range version capable of flying transpacific routes. It is larger and can fly one and a half times as far as the -10.

DC-10-30: By far the most popular model, it was introduced in 1972 and was the first DC-10 to use General Electric turbofan engines, which increased its range beyond even that of the 20 model. It was also the first DC-10 to be offered in a convertible freighter version, and in 1986 was ordered by FedEx in an all-cargo configuration.

DC-10-40: The rarest DC-10 model: it was introduced in 1975 and is essentially a DC-10-20 with improved Pratt & Whitney engines. It has a slightly longer range than the -30 model, but is otherwise very similar in performance. Japan Airlines was the only customer for this type.

KC-10 Extender: A tanker aircraft ordered by the United States Air Force to augment its older KC-135 Stratotanker fleet: on the outside, it is essentially identical to the 30 model. Sixty were built, and continue to operate in the USAF fleet.

General Specifications

Capacity: 277 in three-class configuration: up to 380 in all-economy
Length: 55.3 m
Wingspan: 47.35 m (-10), 50.4 m (-30)
Range: 6100 km (-10), 9400 km (-30)

Major Operators

Today, FedEx, Northwest Airlines, and the Air Force are the largest operators of the DC-10. Most major airlines have sold their DC-10's to either FedEx or the military, and Northwest is waiting on its first Airbus A330 deliveries so it can join its peers.

For more information

Check out: http://home.swipnet.se/~w-48037/

This writeup is to elaborate on the problems the DC-10 experienced.

The Cargo Door:

The locking pins being too short was a secondary cause of the two accidents mentioned. The DC-10 was one of the first pressurized aircraft to be designed whose doors opened out instead of in.

The fuselage of a pressurized airplane is a pressure vessel and as such is subjected to heavy loads at high altitudes. Earlier aircraft had doors that opened in because in order to seal the inner part of the door was wider than the outer part. This created a sort of truncated cone shape. As the pressure differential rose the doors were pressed into the holes and sealed tighter.

The DC-10 was designed with doors that opened outward in order to save space inside the cargo compartment and facilitate easier loading. This required a system of heavy locking pins and a mechanism to operate them.

In the early days of service of the DC-10 airport employees had trouble closing the new style of doors. if the locking pins didn't line up the mechanism didn't operate correctly. On the accident aircraft in question the mechanism was then forced into place. Douglas had designed the mechanism to close easily and work with minimal force. The flaw lay in the linkage in the mechanism. When the door was forced shut it overstressed the mechanism and the linkage bent. This meant that the locking pins hadn't been inserted all the way even though the indicator Douglas included showed "locked." The pressure at altitude eventually overstressed the improperly locked door and blew it out, taking a large portion of fuselage skin and structure with it.

It was later determined that the only difference between the aircraft that was lost and the aircraft that survived was the seating configuration. Literally the saved aircraft was held together by its seat rails.

The changes Douglas made to the cargo door included a simpler mechanism with beefier linkage, a longer throw, and longer locking pins. Airport employees were also trained better.


Engine Pylons:

Eight weeks before the accident the number one engine had been removed and replaced on the accident aircraft to comply with a McDonnell Douglas service bulletin. This R&R was completed using a technique developed by Continental Airlines to remove the entire engine and engine pylon as a single unit, rather than the recommended method of removing the engine and then the pylon. The method developed by Continental involved placing an overhead hoist at the center of gravity of the pylon, removing the pylon attach hardware and lowering the pylon/engine as a single unit. American Airlines adopted this procedure, but used a forklift truck instead of an overhead hoist. This method was difficult however as one incorrect move by the forklift operator could crack the upper rear pylon attach flange. American Airlines had learned this on four other aircraft that had been damaged by this method. Nonetheless the damage in that case was easily detectable and the cost, labor, and time savings were considerable. What American didn't know was that there was another way to damage the upper rear attach flange that wasn't detectable to the human eye. A slight leak in the hydraulic system on the forklift could bend the attach forks of the pylon imperceptibly as the entire load lowered slowly. The attachment of the pylon had a very close tolerance and this bending meant that the tolerance had been ruined and the aft upper flange would eventually fail.

When the accident aircraft had been returned to service it was returned with this fatal flaw. 8 weeks of scheduled service later the aft upper flange failed on takeoff and the remaining attach points were quickly overstressed and failed as well. The engine twisted upward due to aerodynamic pressure and departed the aircraft over the top of the left wing taking a portion of the leading edge skin with it. This alone would not have caused the loss of the aircraft. Indeed several aircraft have lost engine pylons in flight and were able to land safely. The fatal flaw was in the design of the leading edge slat system in the DC-10 and in the company engine out procedures in use.

In the DC-10 all flight controls are hydraulically operated. This included the leading edge slats. When the slats are extended the pressure trapped in the hydraulic system locks them down, this is the only method of down-lock on the leading edge slats. When the engine pylon separated from the aircraft the hydraulic system lines were severed and air loads forced the outboard slats on the left wing to retract. The aircraft was traveling well above the stall speed for the given configuration and accelerating normally but when the slats retracted the stall speed for the left wing increased to 159KIAS. The first officer was flying the aircraft according to company engine failure procedures which unfortunately allowed the aircraft to slow below this speed. The outboard section of the left wing stalled and the aircraft began to roll. The pilots were unable to see the left wing and engine and didn't know that the left wing leading edge slats had moved and as a result didn't recognize the stall. Had they recognized it they could have lowered the nose and accelerated above the stall speed. Unfortunately the stall warning system that would have compensated for the retraction of the leading edge slats was inoperative at the time due to the loss of the electrical system of the number one engine.

Several things were criticized about the design but rather than the actual design parameters more was criticized about certification methods. Douglas had considered the loss of an engine pylon to be akin to that of a horizontal stabilizer or other primary structure and as such designed it to withstand any forseeable loads. In short it was assumed that any normal loads would not cause a pylon to separate just as any normal loads would not cause a wing to separate. The philosophy was that if a wing separated any effect on aircraft systems was pointless to study as the aircraft could no longer fly anyway and as such did not study the effects of a pylon separation on other systems. It was determined that this was well in accordance with certification methods at the time even though it was inherently flawed. Even though the separation of a pylon was improbable it was not impossible. It had happened before and this event would not (as in the case of an entire wing) cause the aircraft to be unable to fly. Douglas' failure to study the effects of this eventuality was cited as a contributing factor in the accident.

Changes made to the DC-10 as a result of this accident were relatively minor. The pylon design was considered adequate. Douglas was required to design in redundancies for the systems that had failed as a result of the loss of the number one engine and add warning systems to indicate asymmetrically deployed control surfaces.

The major changes that came as a result of this accident were to certification policies. All transport category aircraft were required to be designed with more consideration to ease of maintenance and inspection as well as the aforementioned changes in warning and control systems. Maintenance at large carriers, previously allowed a lot of leeway, were watched much more closely. Communication between the FAA and the maintenance facilities was much improved. A service bulletin had been issued that warned of damage to the aft upper pylon attach flange but the language used was vague and it wasn't mentioned in what way the aft upper attach flange could be damaged.

United Airlines Flight 232:

The DC-10 was one of the first transport category aircraft designed with no mechanical flight control redundancy. All reversal of flight controls was accomplished hydraulically. As a result the systems were designed with many built in redundancies. The loss of control surface reversal on United flight 232 was pure chance.

The DC-10 has three completely independant hydraulic systems. One of the built in safeguards was that each flight control surface had at least two hydraulic systems controlling it. If any one system failed the other one or two would provide adequate control. These systems were placed far apart in the aircraft for the exact eventuality that happened to the accident aircraft. The possibility of flying shrapnel from an engine explosion severing all three systems was considered low enough to be impossible and yet that is exactly what happened. When the number two engine exploded shrapnel was thrown into the horizontal stabilizer and aft fuselage and severed all three hydraulic systems leaving all flight controls inoperative.

The only available means of control that remained was differential thrust of the number one and number three engines. Roll and yaw control in this instance is quite easy. Some pitch control is possible because the engine hanging on the pylon creates a lever arm between the engine and the rest of the aircraft. when power on the engines is increased the nose rises, if decreased the nose lowers.

It was by sheer luck that the hydraulics were rendered inoperative and by sheer luck that Capt. Haynes, First officer Records, Flight Engineer Dvorak, and a United check pilot who happened to be deadheading that day, Capt. Fitch, were able to bring the wounded DC-10 in for a rather violent landing at Soux City Gateway Airport. Most of the passengers survived as did all four of the flight crew.

It is interesting to note that this accident was studied in the simulator extensively and even after the fact no one was able to even keep the aircraft flying, let alone land it. And Haynes, Fitch, Records, and Dvorak put the wounded DC-10 right on the end of the runway only slightly left of the centerline. Unfortunately the right wingtip touched down first and pulled the aircraft sideways it subsequently broke apart and exploded.

Nonetheless by crashing the aircraft at the airport, under some control, and in view of the airport crash trucks many lives were saved.

The engine failure was determined to have been caused by a fatigue crack in the stage 1 fan disc of the number two GE CF6-6 engine. The fan disc separated and was found in a field along the aircraft's route of flight. The fan disc had been inspected and returned to service 7 times. the NTSB concluded that human errors caused it to be returned to service with fatigue cracks caused by an undetected metallurgical defect.

Again the NTSB considered the design of the DC-10's hydraulic system to be adequate but still suggested that fail safes be added to prevent complete loss of flight control reversal. Changes to the DC-10 after this accident included changes to the hydraulic system routing and added fail safes to preclude a complete loss of control such as this. Changes to the inspection process at United's engine overhaul shop were also implemented to guard against human error and limitations in the inspection process.