Lies, Damn Lies, and Plane Crashes
The tragic history of the McDonnell-Douglas DC-10 \ MD-11 family of aircrafts
Ed: This piece is dedicated to the families impacted by the tragic UPS2976 crash in Louisville, KY, earlier this month.
(Photo taken August 29, 1970 - McDonnell-Douglas DC-10 prototype, N10DC, takes its first leap into the air at Long Beach - Photo courtesy Boeing)
I want to start this piece by stating that overall, and statistically speaking, air travel is incredibly safe in the year 2025. Much, much safer than it was 60 years ago, and increasing in safety with each passing year. I don’t want this to be a scarepiece, or the reason someone refuses to board a plane - quite the opposite. I’m hoping for it to be a point of reflection, and recognition that we’ve come a far way, and we’ve still got a long way to go.
Modern aircraft have near-endless safety systems meant to ensure seamless, uneventful travel. The industry does a fairly reasonable job learning from its mistakes, and not letting people die in vain. Good practices are made good-er, all in the interest of human well-being. Thankfully, most of this process “just works” and we don’t experience tragedies of the sort anywhere near as often as our society once did.
Alas, it wasn’t always this way — and some aircraft models have better reputations than others. Today’s topic is the tragic yet storied legacy of the longest-lived trijet, the McDonnell-Douglas DC-10/MD-11.
Conception and Birth
(McDonnell-Douglas Building, Long Beach, CA - sometime in 1974 / Photo courtesy Long Beach Public Library Archives)
Dateline: 1965. Douglas Aircraft begins design studies for a new wide-body aircraft based on an unsuccessful submission made in their CX-HLS proposal to the US Air Force - that program would eventually be awarded to Lockheed, who would go on to create the behemoth C-5 Galaxy.
Initial designs for the Douglas wide-body project would start as a 4 engine, double-deck jet (not dissimilar from today’s Airbus A380), aiming for a seating capacity of 550. This however would be eschewed for a more streamlined single-deck trijet, seating just shy of 400 passengers. This decision was reached following surveys of likely customers, and a goal of enhancing “hot and high” climb-out performance metrics during an engine failure scenario, a potential situation some airlines could face at specific high-altitude, hot climate airports.
(Mockup of a potential double deck MD-11, the MD-12, which never came to be. Just pretend it says DC-12 instead, and you sort of get the idea - Photo courtesy of Boeing)
In 1966, American Airlines began shopping a list of requirements to aircraft manufactures, seeking a twin-engine wide body aircraft to compete on routes with the 747, but in a more compact, more economical size. Douglas Aircraft was invited to bid, but instead continued with their trijet wide-body project.
Then, in 1967, Douglas Aircraft merged with the McDonnell Aircraft Corporation to form McDonnell-Douglas, an industry behemoth.
By 1970, the trijet wide-body aircraft design was largely finalized and began its flight test program. Aircraft manufacturer Convair was selected as a subcontractor to manufacture the fuselage. All of this coalescing on August 29th, 1970, where the first DC-10 Series 10 would take its maiden flight, with more than 920 test flights and over 1550 test hours to follow. However, this is where the woes would begin.
Blow out
During a routine ground static test, a pre-production DC-10 had an outward-opening cargo door explosively blow out, which saw a rapid depressurization of the cabin leading to the cabin floor collapsing. This setback, and efforts for re-certification found McDonnell-Douglas and Convair in something of a spat, involving financial liability for such an incident.
Later in 1971, an employee at Convair would speak to the situation in a formal memo, expressing fear that inadequate re-engineering of the cargo door design could lead to loss of an aircraft, and likely loss of human life. As time would prove, he was right to be worried. We’ll get to that shortly.
(An American-Airlines DC-10 Luxury Liner. Photo: JetPix GFDL 1.2, via Wikimedia Commons)
However, those concerns and testing faults aside, the FAA would issue the type certificate to the DC-10, affirming its privilege to serve as a passenger aircraft. Entering service first with American Airlines as the “DC-10 Luxury Liner” in August 1971, with other operators taking delivery through the year, it would become a mainstay in medium to long-haul aviation travel, offering mostly reliable and comfortable travel to the masses.
Which leads us to…
Teething problems, lives hanging in the balance
On a routine flight from Los Angeles to New York with a stop in Detroit, American Airlines flight 96 would experience the aforementioned cargo door blow out. Classified as an “incident” by the FAA and not an air accident, this would be the first of two incidents of a DC-10 losing a cargo door mid-flight, shaking confidence of travelers in this new DC-10 to the core.
While over Windsor, Ontario during climb out from Detroit, the flight suffered what the Captain thought was a mid-air collision, but was in fact the cargo door explosively removing itself from the aircraft.
This caused the rear cabin floor to partially collapse, and control cables from the pilots’ controls to the rudder to become stretched to the limit, with other control cables being severed - causing control issues with the aircraft. Thankfully, AA96 returned without major incident to Detroit Metro airport, with no loss of life, and only 11 injured.
The investigation would find that the cargo door only partially latched into place during loading, likely due to a defect in the locking system. This cascaded into the blow out and collapsed cabin floor.
The rearmost section of the cabin lacked through-holes from the cargo bay into the cabin, which permit air to flow and prevent pressure building against the floor. Other sections of the cabin were equipped with these through-holes. Lacking them in the rear caused a pressurization differential, ending in the floor partially collapsing.
Following this incident, the NTSB suggested changes to the DC-10 in order to prevent similar tragedies in the future: Change the locking mechanism to prevent improper closure/latching, and re-engineering the rear cabin floor to allow ventilation from the cargo area into the rear cabin.
The FAA however sided with McDonnell-Douglas, saying that the additional venting would be difficult to install, and instead chose to focus on the cargo door locking system; McDonnell-Douglas added a small portal window in the bottom of the cargo door that would allow ground crew to visually inspect the latch position. This paired with wiring system upgrades should have, ideally, prevented any repeat incidents.
After the incident, Dan Applegate, Director of Product Engineering at Convair, would pen the previously mentioned memo to Convair management. He touched on several problems with the design of the cargo door - primarily that McDonnell-Douglas had switched from a hydraulic system to an electrical system, which he described as less safe; the floor design being prone to failure if the door were to blow out (potentially severing control surface cables), and reminding everyone that this exact fucking thing happened already during testing in 1970, so what the fuck are we doing here exactly?
His conclusion? An accident was almost certain to again in the future.
The Turkish connection
On the 3rd of March, 1974, Turkish Airlines flight 981 would experience a very similar, and far more deadly cargo door blow out on a routine flight from Istanbul to London via Paris.
On departure from Paris during climb out, flight 981 experienced a rapid decompression somewhere around 23,000 feet - the cargo door violently tearing off from the aircraft and allowing a section of the passenger cabin floor to separate from the frame, to be sucked out from the aircraft with seats still attached; this directly caused the deaths of 6 passengers who were found still in their seats, in a nearby field.
At the same time, all 3 sets of control cables - the primary, and 2 secondary, were severed - leaving the pilots with no chance of recovery or any sort of control. They also lost the ability to control engine #2, which returned to idle at the moment of decompression.
70 seconds later, the 340 remaining souls on board crashed into a forest in Fontaine-Chaalis, Oise, France. At the point of impact, the aircraft was traveling in excess of 480mph, fast enough to shred the plane into near infinite shards. The wreckage was so scattered and fragmented, it was difficult to determine whether any parts of the aircraft were absent prior to the crash. Only 188 bodies were able to be identified, 40 visually. Rescue teams recovered a likely 20,000+ body fragments by the time the operation had concluded.
(Scene from the crash of Turkish Airlines flight 981 - Photo credit unknown)
In the aftermath of Turkish Airlines 981, the previously mentioned memo written by Dan Applegate would be unearthed, and entered into evidence during the civil lawsuits against McDonnell-Douglas that followed.
Commentators at the time blamed McDonnell-Douglas as well as the FAA for failing to learn from American Airlines flight 96. Though there had been some remediation to the cargo door design after that incident, it had been implemented on a voluntary basis, and in a haphazard, patchwork way. Not every airline had complied.
Aviation experts would later say that had the lessons from AA96 been learned and heeded, it’s unlikely Turkish Airlines 981 would have ever had such an incident.
In light of all of this, McDonnell-Douglas would completely redesign the door system, and would quietly settle the civil suit - alongside Turkish Airlines, and other involved parties - for an estimated $100,000,000 (roughly $570,000,000 today).
Thankfully, no additional cargo door incidents would occur following the re-engineering. However, that was just the start of this aircraft family’s woes.
Explosive jettisoning cargo doors, explosive jettisoning engines
(American Airlines flight 191, as captured by Michael Laughlin of Toronto, Ontario, Canada)
The deadliest single-aircraft accident in the United States occurred in 1979, at Chicago O’Hare Airport. American Airlines 191, a DC-10 built in 1972, was on a routine flight from Chicago O’Hare to Los Angeles when its left hand (number 1) engine separated from the wing during takeoff. This was later attributed to damage to the mounting points on the wing at the pylon, a mounting bracket of sorts which holds the engine to the wing - damage caused by improper maintenance procedures at American Airlines.
The aircraft, thundering down the runway to the point of rotation, lost its engine, and was able to reach just 325 feet above the ground - spewing fuel and hydraulic fluid from the now severely damaged left wing as it struggled to maintain altitude.
This loss of hydraulic fluid pressure caused the leading edge outboard slats (left of the engine, facing forward) to retract under force from the air rushing against them, which would see the left wing enter aerodynamic stall. The aircraft then began banking severely to the left, rolling onto its side, reaching a 112* bank angle with the right wing pointed straight up at the sky.
Seconds later, the aircraft would crash into a field just shy of a mile from the end of the runway. Large chunks of aircraft debris were hurled by the impact into an adjacent trailer park, causing 5 trailers to be destroyed, as well as several cars.
The aircraft, fully laden with fuel, started a massive fire - no single component, save for the engines and tail section, remained in tact.
All 271 onboard, plus 2 additional souls on the ground would lose their lives in this tragedy. Additionally, 2 people were critically injured in the post-crash fire.
The investigation would find that prior repair work completed by American Airlines had been insufficient and improper. Like, really fucking bad and stupid and holy shit how do you guys come up with this level of fuckery?!
The NTSB, citing a revised procedure that American Airlines had shared with United Airlines and Continental Airlines as “saving 200 working hours per aircraft” and “reducing the number of items to disconnect”, American et al chose to remove the engine and pylon as a single unit, rather than the engine itself, and then the pylon.
(Depiction of AA191/DC-10 engine and pylon combination under wing - Graphic credit FAA)
While United opted to use an overhead crane to support the engine/pylon combination, American and Continental instead supported the hulking components with a large forklift. This would end in incorrect positioning, and leave the pylon assembly to rock and jam against the wing’s attachment points. Other issues complicated the accident aircraft’s repair - including a shift change, the forks of the forklift moving downward slightly due to hydraulic pressure issues, and a misalignment issue.
This all resulted in fatigue cracking at the wing attachment points which worsened over the 8 weeks between the repair and AA191, each takeoff and landing cycle adding to the stress with the metal mounting points continuing to crack, sealing the deal with the engine and pylon separating from the wing during the accident event.
The NTSB findings would cause to the FAA revoke the DC-10 type certification briefly, the entire DC-10 family being grounded and banned from US airspace. Five weeks later, after re-engineering of the slat actuation system, the grounding would be rescinded.
In November 1979, the FAA fined American Airlines for removing the engine/pylon as a single unit, rather than as separate components as proscribed by the manufacturer McDonnell-Douglas. At that time, the FAA amended the DC-10 type certificate rendering any DC-10 aircraft un-airworthy should the engine and pylon ever be removed as a single unit.
A decade passes without major incident. And then..
(Photo of United flight 232 showing damage to the plane’s horizontal stabilizer - NTSB report)
United 232, a routine flight from Denver to Chicago, crashed in Sioux City, Iowa on July 19, 1989. This incident would be determined to caused by a manufacturing defect in the tail engine’s fan disk, which then caused an “uncontained” failure while at cruising altitude. This allowed shrapnel to penetrate the plane’s horizontal stabilizer, through which all the hydraulic systems of the plane run. All of this resulting in the pilots to losing the ability to control the plane, entering a phugoid cycle.
Fate is a strange thing, though. On board the aircraft that day was a DC-10 flight instructor and United Airlines Captain, Dennis Fitch. When he understood the gravity of the situation, he immediately made his way to the cockpit and helped by taking control of the throttles, mitigating the phugoid cycle and making rough steering adjustments by throttling up and down the engines, while the Captain and First Officer struggled to gain any control with their normal controls.
Air Traffic Control in Sioux City was contacted, an emergency was declared, and an emergency landing at Gateway Airport was coordinated. During this conversation, one of the funniest high-stress situation conversations ever was recorded by the cockpit voice recorder between the air traffic controller and flight Captain Alfred Haynes:
Sioux City Approach: “United Two Thirty-Two Heavy, the wind’s currently three six zero at one one; three sixty at eleven. You’re cleared to land on any runway.”
Haynes: “[laughter] Roger. [laughter] You want to be particular and make it a runway, huh?”
His good humor however was belied by the seriousness of the situation - Captain Haynes and the other people on board his aircraft were essentially in an uncontrollable accident-in-progress, with a near-zero chance of successfully landing the aircraft. Never in history had anyone landed a passenger jet without their control surfaces, let alone able to walk away and to tell the tale about it afterwords.
(Captain Haynes at the controls of a DC-10 in an undated photo, courtesy AP/Sioux City Journal)
The situation was complicated further by the fact that the landing gear system was also hydraulically activated, and failed to drop when commanded. On the DC-10 a manual release system is available in an emergency, and the crew opted to use it. The gear was successfully deployed, and locked into place.
The crew would attempt to dump as much fuel as possible prior to landing, to minimize the risk of post-impact fire. After a series of right turns to jettison the fuel, the crew mistakenly lined up the aircraft with an inactive closed runway, on which the emergency response vehicles were parked in wait for their arrival. These were quickly moved as the aircraft wallowed and pondered its way back to the earth.
During this time, Dennis Fitch would effectively try to land the plane by adjusting the left and right engine thrust values. Since the flaps could not be deployed due to a lack of hydraulic pressure, he and the crew were unable to control the speed, or rate of descent.
(Dennis Fitch, in an undated photo. Credit unknown)
Just seconds before landing, the plane began to roll to the right more considerably, leading the aircraft to pitch forwards into a dive. Fitch realized this and pushed both throttles to full power in hopes of bringing the nose back up, a desperate attempt to get the plane to level out. It was too late. Large turbofan jet engines take time to spool up and provide thrust, and immediately following his attempt the plane struck the ground, the right wing impacting first.
This caused a considerable fire, as the wings contain sizable fuel tanks. As the plane continued its inelegant reunion with earth, the tail section broke off, and the fuselage bounced several times; breaking into large segments. On the final impact, the right wing was torn off, and the majority of the fuselage skidded sideways, rolling onto its back, sliding to a stop upside down in a corn field just to the right of the runway.
(Wreckage of United 232 - Photo credit Iowa Department of Public Safety)
Of the 296 onboard, 111 would die in the accident and one more would die a day later in hospital. Rescue teams did not identify the cockpit, with Captain Haynes, Dennis Fitch, and two additional crew still miraculously alive, for 35 agonizing minutes. Thankfully, they would all eventually recover from their injuries and return to flight duty not long after.
The investigation team discovered that the rear engine fan disk and blade assembly - an 8ft wide part made of titanium and other expensive space-age alloys - was not part of the crash wreckage. The engine manufacturer, GE, put up a $50,000 reward for the disk and $1,000 per fan blade, with a farmer finding a large chunk of fan disk and several blades some 3 months later in her field. The rest of the components were found not far away from that farm over the following days.
The NTSB found the probable cause of the accident was “inadequate consideration given to human factors limitations in the inspection and quality control procedures used by United Airlines’ engine overhaul facility, which resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the Stage 1 Fan disk, manufactured by General Electric Aircraft Engines. Subsequent catastrophic disintegration of the disk resulted in the ‘liberation’ of debris in a pattern of distribution and with energy levels that exceeded the level of protection provided by design features of the hydraulic systems that operate the DC-10 flight controls.”
In short, United mechanics weren’t able to see fatigue cracking in a giant spinning metal fan blade disk, and this lead to shredded chunks of metal being sent through the tail of the aircraft, slicing and dicing and Ron Popeiling the hydraulic lines to shit.
(You know I had to make a Ron Popeil joke. Nobody does that anymore.)
This incident caused McDonnell-Douglas to redesign the hydraulic system in the upcoming DC-10 replacement aircraft, the MD-11, to incorporate ‘hydraulic fuses’; essentially cut-off valves that prevent total system functionality from being lost in a similar situation. This redesign would also be applied as a retrofit to all DC-10 aircraft to ensure sufficient control if hydraulic system lines were damaged in the tail area.
MD-11 and the last gasps of a dying McDonnell-Douglas
(McDonnel-Douglas MD-11 promotional photo - Courtesy of Boeing)
The final DC-10 was to be produced in 1989, so by 1986 McDonnell-Douglas had begun designing a replacement for its venerable, if sometimes dangerous DC-10. This new aircraft, dubbed MD-11, would be one of the last aircraft designed by the storied mark.
The MD-11, essentially a mild rework of the DC-10, was stretched in length by 11% compared to DC-10 and offered new wing designs, new engines, new cockpit equipment and a much longer range. Positioned as a longer-range alternative to twin-engine jets such as the Boeing 767, 777, and Airbus A330, the MD-11 would fail to meet its range and fuel burn targets, which would lead to slower than expected sales, contributing to the downfall of McDonnell-Douglas.
McDonnell-Douglas would struggle on financially, preventing further development and refinement to the MD-11. McDonnell-Douglas would eventually be acquired by Boeing in 1997, and only 200 MD-11 aircraft would be built by the time production ended in 2000; a quarter of which were MD-11F freighter models.
(Finnair, the Finnish flag carrier, was a launch customer for the MD-11. Photo credit unknown)
Thankfully, the MD-11 has a far less tarnished legacy compared to the DC-10. No major whoopsies to discuss. No design defects causing planes to break apart mid-air. No engines yeeting themselves from the chat. No fan disks flinging shards of itself into the hydraulic lines.
The majority of incidents involving the MD-11 seem to be caused by weather or pilot error during landing. One notable incident was caused by faulty wiring for passenger in-flight entertainment systems, leading to an onboard fire.
Except for…
UPS2976
(UPS N259UP, MD-11F, on arrival at Portland International, September 2021 - Photo credit Yan777/JetPhotos.net)
On the evening of November 4, 2025, UPS2976 crashed during takeoff from Louisville Muhammad Ali International, bound for Honolulu, Hawaii. 3 on board and 11 on the ground were killed. This is the deadliest accident involving UPS Airlines to date.
Striking an eerily similar nature to AA191 discussed earlier, UPS2976 would lose its left hand #1 engine during takeoff, causing it to separate from the wing, leaving the aircraft struggling to gain altitude as it scraped the left landing gear across the roof of a UPS warehouse, limped across a road, and in to a series of businesses at the end of the runway.
The left wing dipping into the ground and the right wing pointed at the sky, the aircraft would lurch through a petroleum recycling facility and into a junkyard, plowing into the earth, causing a catastrophic fireball and scattering debris in all directions.
NTSB press conferences have given us some key information:
The aircraft likely didn’t gain more than 100ft of altitude before crashing
An engine fire bell was heard in the cockpit starting 37 seconds after setting takeoff thrust, and continued until the impact
The left hand #1 engine was found attached to a “majority” of the pylon, roughly 4/5 of the way down the runway
The investigation is ongoing, and no official cause has yet to be determined.
In the wake of the hideous crash, the FAA has ordered the grounding and inspection of all MD-11F aircraft. No passenger MD-11s remain in service, with the last flight happening in 2014.
The Weird Era of the Trijet and the Losing Battle
(The main competition to the DC-10, the Lockheed L-1011, shown here with Delta Air Lines as N751DA - Photo credit Delta Flight Museum / Delta Air Lines)
So what exactly was the point of the trijet? Why have 3 engines when 2 good, and 4 good-er?
In short, ETOPS. Engine Turns or Passenger Swims, or “Extended-range Twin-engine Operations Performance Standards” requirements. ICAO has a set of standards which require planes to stay within a specific flight time from alternate airports when over water or remote territories, in case of an engine failure mid-flight. There’s more to it, but I’m trying to keep it simple to keep your eyes from glazing over.
The essence of it is simple: There’s a maximum amount of time a jet engine can provide maximum thrust on its own before it also starts to break down and throw in the towel. When this happens, ideally you’ll be close enough to an airport (or at least a population center of some kind) that rescuers can get to you in a quick manner.
(A Southwest Boeing 737-800 proudly displaying its ETOPS status - Photo credit unknown)
Airlines love flying long distances, but don’t like the indirect routings afforded by ETOPS. They love the idea of packing hundreds of people into flying cans, but don’t want the fuel economy or repair bills of a 4-engine aircraft. So, the trijet was born. No need to worry about 2 engine rules when you have 3, and no need to worry about the fuel bill or maintenance bills for a 4th engine.
However, engine technology continued to improve after the 1970s, and ETOPS would be extended from a 90 minute rule to 120, then 180 - and on to 240, and 330, peaking at 370. ETOPS would be applied to 4 engine aircraft like the 747-800, A340, and A380, called EDTO. EDTO would offer 330 minutes of range on a given flight, meaning nearly every place on Earth was reachable.
Eventually, a twin engine jet, the Boeing 777, would achieve ETOPS 330 status. The Airbus A350 XWB would best this by being granted ETOPS 370, allowing 370 minutes of distance from its alternative airports, meaning it effectively can fly over 99.7% of places on Planet Earth.
(A chart showing a list of ETOPS60/120 alternative airports on a flight from New York to London - Graphic credit Aviation Stack Exchange)
Large twin jet aircraft like the Boeing 767, 777, 787 and Airbus A330/A350 made the trijet obsolete as the amount of time they were afforded under ETOPS increased. There simply wasn’t a need to carry a redundant engine in the tail just to satisfy some bureaucratic insistence.
Even narrow-body aircraft like the Boeing 737 and Airbus A220/A320 were granted additional ETOPS time, extending their range considerably and further cementing the trijet headstone into the ground.
The world the trijet was born into no longer existed. Modern twin-jet engines are durable enough and more than sufficient to sustain overwater flights, and when they aren’t, planes with 4 engines have the legs to keep going. The fuel economy trade off and maintenance overhead is too much to justify a third engine, just for the sake of having a third engine.
And with that, the trijet era came and went. With several bangs. And a whole lot of corpses.
I will fly on a plane when commercial gravity neutralization technology is finally rolled out.
back in business... saved for later :)