Understanding Air Safety in the Jet Age/Terror at 22,000 ft - United Airlines Flight 811

The aircraft after the cargo door tore off in flight, causing explosive decompression and ejecting nine passengers from the aircraft|thumb|right On 24 February 1989 when 59 year old Captain David M. Cronin, a hugely experienced pilot, just two flights from retirement, with 28,000 flight hours, took charge of United Airlines Flight 911 little did he know that he'd soon be fighting to save his passengers - and crew - from an entirely avoidable accident. Soon after taking off from Honolulu, the cargo-door failed. The resulting explosive decompression blew out several rows of seats, killing nine passengers, at least one of whom ended up in the engine. The unfortunate victims remains were never found. Shockingly, the fault that caused this accident was well known in the industry. thumb|left|The same aircraft in 1993, after being repaired and re-registered as N4724U The aircraft involved was a Boeing 747-122 that was delivered to United Airlines on 3 November 1970. It was well used having accumulated over 58,000 flight hours and 15,000 pressurisation cycles. On the day of the accident it was scheduled to fly from Los Angeles International Airport to Sydney Airport with intermediate stops at Honolulu International Airport and Auckland Airport in New Zealand. There were no problems on the first legs of the flight. Alongside Cronin was First Officer Gregory Allen "Al" Slader, aged 48, also hugely experienced with more than 14,000 hours, and Flight Engineer Randal Mark Thomas, 46. Looking after the 337 passengers were 15 flight attendants. Flight 811 took off from Honolulu International Airport at 01:52. During the climb, the crew made preparations to detour around thunderstorms along the plane's track; the captain anticipated turbulence and kept the passenger seatbelt sign lit. thumb|The massive hole in the fuselage The aircraft had been flying for 17 minutes and was passing 22,000 ft when the flight crew heard a loud "thump", which shook the plane. About a second and a half later, the forward cargo door separated from the aircraft. It swung out with such force that it tore a massive hole in the fuselage. This caused the plane to slightly bank to the left. The pressure differential and aerodynamic forces caused the cabin floor to cave in, and 10 seats (G and H of rows 8 through 12) were ejected from the cabin along with their unfortunate occupants along with the passenger in seat 9F who hadn't fastened his seatbelt. By luck the plane wasn't full and seats 8G and 12G were unoccupied. A gaping hole was left in the aircraft, through which a flight attendant, Mae Sapolu, in the business class cabin, was almost blown out. Purser Laura Brentlinger hung on to the steps leading to the upper deck and was dangling from them when the decompression occurred. Passengers and crew members saw her clinging to a seat leg and were able to pull her back inside the cabin, although she was severely injured. thumb|left|9 passengers were ejected through this massive hole in the fuselage The pilots initially believed that a bomb had gone off inside the airliner, as this accident happened just two months after Pan Am Flight 103 was blown up over Lockerbie, Scotland. They began an emergency descent to reach an altitude where the air was breathable while also performing a 180° left turn to fly back to Honolulu. Adding to the passenger's terror and panic as they struggled to breathe, the explosion damaged components of the emergency oxygen supply system as it was primarily located in the forward cargo sidewall area, just aft of the (now missing) cargo door. They would have been even more terrified - if that was even possible - if they had known the pilots also had no oxygen. The flight attendants had portable oxygen bottles, but even these were problematic as the masks were not fitted to the bottles and the attendants struggled to attach them while struggling to breathe. As well as dealing with the depressurisation and the need to descend, the pilots had to deal with the potential loss of two of the four engines. The debris ejected from the aircraft during the explosive decompression damaged the Number 3 and 4 engine - engine 3 was experiencing heavy vibration, and showed zero revolutions on the tachometer as well as a low exhaust-gas temperature and engine-pressure ratio leaving the crew with no choice but to shut it down. At 02:20, an emergency was declared, and the crew began dumping fuel to reduce the aircraft's landing weight. Engine number 4 soon also fell to almost zero revs, and it was emitting flames, so the pilots shut it down as well. Some of the explosively ejected debris also damaged the right wing's leading edge, dented the horizontal stabilizer on that side, and damaged the vertical stabilizer. It was a miracle it was still flying. During the descent, Captain Cronin ordered Flight Engineer Thomas to tell the flight attendants to prepare for an emergency landing, but Thomas could not contact them through the intercom. Thomas asked the captain for permission to go down to find out what was happening, and Cronin agreed. Thomas saw severe damage immediately upon leaving the cockpit; the aircraft skin was peeled off in some areas on the upper deck, revealing the frames and stringers. As Thomas went down to the lower deck, the magnitude of the damage became apparent as he saw the large hole in the side of the cabin. Thomas returned to the cockpit and reported that a large section of the fuselage was open aft of the Number 1 exit door. Thomas concluded that it was probably a bomb and that considering the damage, slowing below the plane's stall speed by more than a small margin would be unwise. thumb|Damage visible after landing As the airliner neared the airport, the landing gear was extended, but the flaps could only be partially deployed as a result of damage sustained following the decompression. This necessitated a higher-than-normal landing speed around 190 knots. Despite all these problems, Captain Cronin was able to bring the aircraft to a halt without overrunning the runway. Fourteen minutes since the emergency was declared, all the remaining passengers and crew were able to evacuate the plane although every flight attendant suffered some injury during the evacuation, ranging from scratches to a dislocated shoulder. Despite extensive air and sea searches, no remains of the nine victims lost in flight were found at sea. Investigation thumb|Flight 811 after landing The National Transportation Safety Board (NTSB) immediately commenced an investigation into the accident. An extensive aerial and surface search of the ocean had initially failed to locate the aircraft's cargo door. The NTSB proceeded with its investigation, without the cargo door to inspect, issuing a final report on 16 April 1990. thumb|A view of the engines from the hole in the fuselage The investigation relied heavily on circumstantial evidence, including prior incidents involving cargo doors. On 10 March 1987, Pan Am Flight 125, another Boeing 747, outbound from London Heathrow Airport, had pressurisation problems at 20,000 f, causing the crew to abort the flight and return to the airport. After that aircraft landed safely back at London Heathrow Airport, the aircraft's cargo door was found to be ajar by about 1.5 inches along its ventral edge. When the aircraft was examined further, all of the door's locking arms were found to be either damaged or entirely sheared off. Boeing initially attributed this to mishandling by ground crew. To test this theory, Boeing instructed 747 operators to shut and lock the cargo door with the external handle and then activate the door-open switch with the handle still in the locked position. Nothing should have happened since the S-2 switch was designed to deactivate the door motors if the handle was locked. Some airlines reported that the door motors did indeed begin running; however, they attempted to force the door open against the locking sectors and caused damage to the mechanism. Based on the evidence available and the attribution of prior cargo door malfunctions to damage caused by ground crew mishandling, the NTSB's investigative findings were rooted in the supposition that a properly latched and locked 747 cargo door could not open in flight: There are no reasonable means by which the door locking and latching mechanisms could open mechanically in flight from a properly closed and locked position. If the lock sectors were in proper condition and were properly situated over the closed latch cams, the lock sectors had sufficient strength to prevent the cams from vibrating to the open position during ground operation and flight. Nonetheless, there are two possible means by which the cargo door could open while in flight. Either the latching mechanisms were forced open electrically through the lock sectors after the door was secured, or the door was not properly latched and locked before departure. Then, the door opened when the pressurization loads reached a point that the latches could not hold. The NTSB learned that in N4713U's case, the aircraft had experienced intermittent malfunctions of its forward cargo door in the months before the accident. Based on this information and the presumption of in-service damage, the NTSB concluded in its April 1990 report that these malfunctions had damaged the door locking mechanism, in a way that caused the door to show a latched and locked indication without being fully latched and locked. The report criticized the component design; it also criticized the airline for improper maintenance and inspection and thus failing to identify locking mechanism damage. The Boeing 747 was designed with an outward-hinging cargo door, unlike a plug door, which opens inward and jams against its frame when closed as the pressure drops outside in flight, making accidental opening at high altitude impossible. The outward-swinging door increases the aircraft's available cargo capacity (less room inside the fuselage must be kept clear to accommodate the door's range of motion) but requires a strong locking mechanism to keep it closed. Deficiencies in the design of wide-body aircraft cargo doors have been known since the early 1970s due to flaws in the McDonnell Douglas DC-10 cargo door. These problems were not fully addressed by the aircraft industry or the Federal Aviation Administration despite the warnings and deaths from the DC-10's cargo door-related accidents. The 747's cargo door used a series of electrically operated latch cams into which the door-edge latch pins closed. The cams then rotated into a closed position, holding the door closed. A series of L-shaped arms (called locking sectors) were actuated by the final manual movement of a lever to close the door; these were designed to reinforce the unpowered latch cams and prevent them from rotating into an unlocked position. The locking sectors were made out of aluminium, however, and they were too thin to keep the latch cams from moving into the unlocked position against the power of the door motors. Electrical switches cut electrical power to the cargo door when the outer handle was closed; if one was faulty, the motors could still draw power and rotate the latch cam to the open position. The same event could happen if frayed wires could power the cam motor, even if the safety switch cut the circuit power. As early as 1975, Boeing realised that the aluminium locking sectors were too thin to be effective and recommended the airlines add doublers to the locking sectors. After the 1987 Pan Am incident, Boeing issued a service bulletin notifying operators to replace the aluminium locking sectors with steel locking sectors and conduct various inspections. In the United States, the FAA mandated this service through an airworthiness directive in July 1988 and gave U.S. airlines 18 to 24 months to comply with it. After the Flight 811 accident, the FAA shortened the deadline to 30 days. thumb|The cargo door was recovered by crewed deep-sea submersible Sea Cliff. On 26 September and 1 October 1990, two halves of Flight 811's cargo door were recovered by the crewed deep-sea submersible Sea Cliff from the Pacific Ocean at a depth of 14,000 feet. The cargo door had fractured lengthwise across the centre. No other debris or evidence of human remains was discovered. The NTSB inspected the cargo door and determined that the condition of the locking mechanism did not support its original conclusions. thumb|Another view of the cargo door Additionally, in 1991, an incident occurred at New York's John F. Kennedy International Airport involving the malfunction of another United Airlines Boeing 747 cargo door. At the time, United Airlines' maintenance staff was investigating the cause of a circuit-breaker trip. In diagnosing the cause, an inadvertent operation of the electric door latch mechanism caused the cargo door to open spontaneously despite being closed. An inspection of the door's electrical wiring discovered insulation breaches, and isolating certain electrical wires allowed the door to operate normally again. The lock sectors, latch cams, and latch pins on the door were inspected, and did not show any signs of damage of the type predicted by the NTSB's original hypothesis. Based on developments after it issued its original report in April 1990, the NTSB issued a superseding accident report on 18 March 1992. In this report, the NTSB determined that the probable cause of the accident was the sudden opening of the cargo door, which was attributed to improper wiring and deficiencies in the door's design. It appeared in this case that a short circuit caused an unordered rotation of the latch cams, which forced the weak aluminium locking sectors to distort and allow the rotation, thus enabling the air pressure differential and aerodynamic forces to blow the door off the fuselage, ripping away the hinge fixing structure, the cabin floor, and the side fuselage skin, and causing the explosive decompression. thumb|The cargo door handle The NTSB recommended that all 747-100s in service at the time replace their cargo door latching mechanisms with new, redesigned locks. What can we conclude? That the airline industry learns too slowly.