American Airlines Flight 96 — The Door That Nearly Did It First

American Airlines Flight 96 is the accident that should have prevented THY 981. On 12 June 1972, two years before 346 people died over Paris, the identical cargo door failure mode caused the same aft cargo door to blow out on the same aircraft type over Windsor, Ontario. The floor partially collapsed. The control cables were damaged — but not severed. The crew recovered the aircraft and landed safely at Detroit Metropolitan Airport. All 67 people on board survived.

The failure mode was documented in exquisite detail. The correction was designed and issued. The regulatory response was agreed. And then, through a combination of deference to commercial interests and a willingness to accept documentation as a substitute for verification, the exact same failure was allowed to kill 346 people twenty-one months later.

AA 96 is aviation’s most important precursor event case study — the incident that contained every signal required to prevent the subsequent catastrophe, and whose signals were treated as resolved when they were not.

AA 96 gave the aviation system everything it needed to prevent THY 981. The system chose not to use it.

Date	12 June 1972
Flight	AA 96
Aircraft	McDonnell Douglas DC-10-10
Operator	American Airlines
Fatalities	0 — crew recovered the aircraft; all 67 on board survived
Category	Design Failure / Cargo Door / Precursor Event / Regulatory Missed Opportunity
Location	Over Windsor, Ontario, Canada

The Event

12 June 1972: DC-10 climbs through 11,750 feet over Windsor, Ontario
Aft cargo door fails — identical mechanism to what will later kill THY 981
Floor partially collapses; six seats fall into cargo hold
Control cables damaged but not fully severed — partial control retained
Captain Bryce McCormick uses differential engine thrust to control pitch and roll
Aircraft landed safely at Detroit Metropolitan Airport; all 67 on board survive
NTSB and FAA investigation fully documents the failure mode
McDonnell Douglas issues Service Bulletin SB 52-27; FAA and manufacturer agree to voluntary administration
The structural modification — drilling a vent hole — is not made mandatory
21 months later: THY 981 suffers identical failure; floor fully collapses; cables severed; 346 die

Captain Bryce McCormick’s recovery of the aircraft using differential thrust was an act of exceptional airmanship that previewed the techniques later used by United 232 Captain Al Haynes in 1989.

Systems Engineering Perspective

From a systems engineering perspective, AA 96 is not primarily an accident — it is a system learning opportunity that the system failed to exploit. Every technical element of the failure was identified, analysed, and understood. A physical correction was designed and issued. The failure was the regulatory and administrative system that treated the voluntary implementation of that correction as adequate assurance of compliance.

A precursor event that is fully understood but not fully corrected is not a safety improvement. It is a delayed catastrophe with a documented countdown.

The Latent Design Flaw — Fully Understood, Insufficiently Corrected

The DC-10 aft cargo door latch mechanism had a specific, well-understood failure mode: the handle could be physically forced to the stowed position without the locking pins having fully engaged. This created a false-closed condition that would not be detected by visual inspection of the external handle.

Following AA 96, McDonnell Douglas’ engineers identified the root cause and designed a straightforward fix: drilling a small vent hole in the door structure to allow pressure equalisation between the cargo hold and the external environment. This would prevent the pressure differential from slamming the door open, even if the latch was not fully engaged. The fix was sound. The issue was whether it was performed.

The engineering solution to the DC-10 cargo door flaw existed and was understood within weeks of AA 96. The failure was not technical — it was administrative.

The Gentleman’s Agreement — Regulatory Deference to Commercial Interest

The standard FAA response to a demonstrated, safety-critical design defect in a type-certificated aircraft is to issue an Airworthiness Directive — a mandatory, legally binding instrument requiring all operators to implement the specified corrective action within a defined timeframe, with documented evidence of compliance.

Following AA 96, the FAA and McDonnell Douglas agreed instead on a voluntary arrangement. McDonnell Douglas would issue a Service Bulletin; operators would implement it; the FAA would not issue a mandatory AD. The rationale was commercial and relational — an AD would imply that McDonnell Douglas had certified a defective aircraft, with significant legal and reputational consequences.

This decision prioritised the manufacturer’s commercial and legal position over the passengers’ physical safety. It is the most consequential regulatory misjudgement in aviation history.

When the regulatory response to a known design defect is calibrated to minimise commercial damage to the manufacturer rather than to maximise safety assurance for the operator, the regulatory system has inverted its purpose.

Documentation Without Verification

The Turkish Airlines aircraft involved in THY 981 had maintenance documentation suggesting that the service bulletin modification had been implemented. Physical examination of the wreckage confirmed that the vent hole had not been drilled — the core structural fix had not been performed.

A signed work order existed. The physical modification did not. This is the documentation-without-verification failure that mandatory ADs with independent compliance checks are specifically designed to prevent. The Gentleman’s Agreement had no such mechanism.

Human Factors Perspective

The human factors dimension of AA 96 operates at two levels. At the operational level, Captain McCormick’s recovery of the aircraft is an extraordinary demonstration of adaptive airmanship. At the systemic level, the human failure was in the decision-making of regulators and manufacturers who treated commercial considerations as relevant inputs to a safety decision.

Adaptive Airmanship Under Severe Degradation

When the floor partially collapsed on AA 96, Captain McCormick lost normal pitch and roll control. He had no training, no checklist, and no simulator experience for the specific condition he faced. He improvised differential engine thrust as a control mechanism — anticipating by 17 years the identical technique used by Captain Al Haynes on United 232.

This type of adaptive response — applying fundamental aerodynamic principles in a novel emergency — requires a depth of understanding that goes beyond procedure compliance. McCormick’s recovery is a case study in knowledge-based performance under conditions that no procedure had anticipated.

Procedural training prepares crews for expected emergencies. Knowledge-based training prepares crews for unexpected ones. AA 96 and United 232 both required knowledge-based performance.

The Regulatory Decision Under Commercial Pressure

The decision-makers who agreed to the Gentleman’s Agreement were not corrupt or negligent. They were operating in an environment in which the commercial and reputational consequences of an Airworthiness Directive against a major manufacturer were significant and immediate, while the safety consequences of voluntary non-compliance were probabilistic and deferred.

This is the human factors of organisational decision-making: the tendency to weigh tangible, immediate costs more heavily than probabilistic future costs. The regulatory system, like any system operated by humans, is vulnerable to this bias. Post-THY 981, the aviation regulatory architecture was redesigned to reduce the space in which this bias can operate.

System Interaction Breakdown

1. Known Failure Mode — No Mandatory Response

The failure mode was demonstrated, documented, and physically present in every unmodified DC-10 in service. The absence of a mandatory corrective action allowed it to remain in those aircraft. The system treated ‘issued’ as equivalent to ‘implemented.’

‘The Service Bulletin has been issued’ and ‘the modification has been performed’ are not the same statement. Treating them as equivalent is a safety system failure.

2. Survival as False Signal

The survival of all 67 people on AA 96 provided a misleading signal: the failure was survivable, therefore the risk was manageable. This is a classic survivorship bias in safety management. The survival was not because the failure was safe — it was because partial cable severance left marginal control authority, and because an exceptionally skilled captain was able to exploit it. THY 981 showed what happened when the cables were fully severed.

3. Twenty-One Month Window of Known Risk

Between AA 96 in June 1972 and THY 981 in March 1974, every unmodified DC-10 aft cargo door in the world was a known risk awaiting a trigger. The system knew this. The system accepted it. The 346 people who died on THY 981 did not.

A twenty-one month window between a known failure mode and its lethal repetition is not a failure of detection. It is a failure of response.

Significance in Aviation Risk

1. Precursor Events Are The Most Valuable Safety Asset

AA 96 is the defining case study for the principle that precursor events — incidents that reveal a failure mode without producing a fatality — are more valuable than any other safety signal. They provide the information needed to prevent the catastrophic outcome. The system’s obligation is to treat them as if the catastrophe had already occurred, because without intervention, it will.

2. Mandatory ADs Cannot Be Optional

The post-THY 981 redesign of regulatory practice established that known, demonstrated safety-critical defects require mandatory Airworthiness Directives with independently verified compliance. The Gentleman’s Agreement is the reason this principle now has the force of law in every major aviation regulatory framework.

3. Differential Thrust as Emergency Technique

The technique developed by McCormick — and later by Haynes on United 232 — was formally incorporated into emergency training for all transport aircraft following these events. A technique born of necessity became a standard tool.

Closing Perspective

American Airlines 96 is the case that answers the question every safety practitioner should ask after every survivable incident: ‘What would have happened if this had been slightly worse?’ In AA 96’s case, the answer was THY 981. The system knew the answer. It chose not to act on it.

The principle that AA 96 established — and that THY 981 wrote in blood — is that the aviation safety system exists not to respond to accidents, but to prevent the accidents that the precursor events are signalling. Precursor events are gifts. They show us what is coming. The obligation is not to survive them — it is to learn from them.

The regulatory reforms that followed THY 981 gave that obligation the force of law. Mandatory ADs, independent verification of compliance, and the prohibition on treating documentation as a substitute for physical inspection are all, at their root, the legacy of the aircraft over Windsor that should have been enough.

AA 96 is the accident that shows what a safety system should do with a near miss. THY 981 is the accident that shows what happens when it doesn’t.