United Airlines Flight 811

Aircraft

The aircraft involved was a Boeing 747-122 (registration number N4713U). It was delivered to United Airlines on October 20, 1970. At the time of the incident, the plane had accumulated 58,815 total flight hours, and had not been involved in any previous accident.

On February 24, 1989, the aircraft was scheduled by United Airlines to operate as Flight 811 from San Francisco International Airport in San Francisco, California, to Sydney Airport in Mascot, New South Wales, Australia, with intermediate stops at Los Angeles International Airport in Los Angeles, California, Honolulu International Airport in Honolulu, Hawaii, and Auckland Airport in Auckland, New Zealand.

Flight 811 operated without incident on the first two legs of its scheduled flight, from San Francisco to Los Angeles and Los Angeles to Honolulu. Upon arriving at Honolulu, a crew change occurred. The previous flight crew reported no difficulties with the aircraft during their flight to Honolulu.

Flight crew

Starting in Honolulu, Flight 811 was helmed by Captain David Cronin, age 59. At the time of the incident, Cronin had logged around 28,000 flight hours, including approximately 1,600 to 1,700 hours in Boeing 747 aircraft. Flight 811 was Cronin's second-to-last scheduled flight before his mandatory retirement.

The remaining flight crew consisted of First Officer Al Slader, age 48, and Flight Engineer Randal Thomas, age 46, and a total of 15 flight attendants. The first officer and flight engineer had logged 14,500 flight hours and 20,000 flight hours, respectively.

Incident

Flight 811 departed Honolulu International Airport at approximately 01:52 HST with three flight crew, 15 flight attendants, and 337 passengers aboard.

During the climb, the crew made preparations to detour around thunderstorms along the aircraft's track; the captain anticipated turbulence and kept the passenger seatbelt sign lit. The plane had been flying for approximately 16 minutes and was passing from 22,000 feet (6,700 m) to 23,000 feet (7,000 m) when the flight crew heard a loud "thump" which shook the aircraft. One and a half seconds later, the forward cargo door blew out. The door swung out with such force that it passed its normal stop and slammed into the side of the fuselage, bursting the fuselage open. Pressure differentials and aerodynamic forces caused the cabin floor to cave in, and ten seats (G and H of rows 8 through 12) were ejected from the cabin. All eight passengers seated in these locations were killed (seats 8G and 12G were unoccupied), as was the passenger in seat 9F, whose seatbelt failed. A gaping hole was left in the aircraft, through which a flight attendant in the business-class cabin was almost blown out of the aircraft. Passengers and crew members saw her clinging to a seat leg and were able to pull her back inside the cabin, although she was severely injured. Senior flight attendant Laura Brentlinger hung on to the steps leading to the upper deck, and was dangling from them when the decompression occurred.

The pilots initially believed that a bomb had gone off inside the airplane, as this accident happened just eight weeks after Pan Am Flight 103 was blown up over Lockerbie, Scotland. They began an emergency descent in order to reach an altitude where the air was breathable, while also performing a 180-degree left turn to fly back to Honolulu. The explosion damaged components of the on-board emergency oxygen supply system, as it was primarily located in the forward cargo sidewall area, just aft of the cargo door.

The debris ejected from the airplane during the explosive decompression caused severe damage to the Number 3 and 4 engines, causing visible fires in both. The crew did not get fire warnings from either engine. Engine 3 was experiencing heavy vibration, no N1 reading, and a low EGT and EPR, so the crew shut it down. At 02:10, an emergency was declared and the crew began dumping fuel to reduce the aircraft's landing weight. Initially, the pilots pushed the Number 4 engine slightly, but they noticed that its N1 reading was almost zero, its EGT reading was high, and it was emitting flames, so they shut it down as well. Some of the explosively ejected debris damaged the right wing's leading edge, dented the horizontal stabilizer on that side, and damaged the vertical stabilizer.

During the descent, Captain Cronin ordered Flight Engineer Thomas to tell the flight attendants to prepare for an emergency landing, but Thomas was unable to contact them through the intercom. He asked the captain for permission to go down to find out what was happening, and Cronin agreed. Thomas saw severe damage immediately upon leaving the cockpit; the aircraft's skin was peeled off in some areas on the upper deck, revealing the frames and stringers. As he went down to the lower deck, the magnitude of the damage became apparent as he saw the large hole in the side of the cabin. Thomas returned to the cockpit and reported that a large section of fuselage was open aft of the Number 1 exit door. He concluded that it was probably a bomb and that, considering the damage, it would be unwise to exceed the airplane's stall speed by more than a small margin.

As the airplane neared the airport, the landing gear was extended. The flaps could only be partially deployed as a result of damage sustained following the decompression. This resulted in a high landing speed of around 190–200 knots (350–370 km/h). Cronin was able to bring the airplane to a halt without overrunning the runway. Fourteen minutes had elapsed since the emergency was declared. Evacuation was carried out and all remaining passengers and flight attendants exited the plane in less than 45 seconds. Every flight attendant suffered some injury during the evacuation, ranging from scratches to a dislocated shoulder.

Despite extensive air and sea searches, no remains were found at sea of the nine victims lost in flight. Multiple small body fragments and pieces of clothing were found in the Number 3 engine, indicating that at least one victim was ejected from the fuselage into the front of the engine, but it was not known whether the fragments were from one or more victims. The passenger with the seatbelt malfunction was seated farthest from the hole in the plane, so he was likely the last victim ejected and with the least velocity; he was also the only victim not ejected with his seat (a seat entering the engine would have caused immediate destruction of the engine). Therefore, it is likely that the remains found inside the Number 3 engine were his. It was deemed highly unlikely that any victims were alive during their four-minute descent to the ocean's surface, given the aircraft's altitude and speed, the force of the ejection, and that debris struck and damaged much of the aircraft's external structure.

NTSB initial investigation

The National Transportation Safety Board immediately commenced an investigation into the accident. However, an extensive air and surface search of the ocean had failed to locate the aircraft's cargo door. The NTSB proceeded with its investigation, and issued its final report on April 16, 1990, without the cargo door.

Without the benefit of the cargo door to inspect, the NTSB looked to circumstantial evidence including prior incidents that involved cargo doors. In 1987, Pan Am Flight 125 outbound from London Heathrow Airport encountered pressurization problems at 20,000 feet (6,100 m), causing the crew to abort the flight and return to the airport. After the safe landing, the aircraft's cargo door was found to be ajar by about 1.5 inches (3.8 cm) along its ventral edge. When the aircraft was examined in a maintenance hangar, all of the locking arms were found to be either damaged or sheared off entirely. Boeing initially attributed this to mishandling by ground crew. To test this concern, Boeing instructed 747 operators to shut and lock the cargo door with the external handle, and then activate the door-open switch with the handle still in the locked position. Since the S-2 switch was designed to deactivate the door motors if the handle was locked, nothing should have happened. Some of the airlines reported the door motors did indeed begin running, attempting to force the door open against the locking sectors and causing damage to the mechanism.

Based on the evidence available, and the attribution of prior cargo door malfunctions to damage and ground crew mishandling, the NTSB operated from an assumption that a properly latched and locked 747 cargo door could not open in flight:

There are no reasonable means by which the door locking and latching mechanisms could open mechanically in flight from a properly closed and locked position. If the lock sectors were in proper condition, and were properly situated over the closed latch cams, the lock sectors had sufficient strength to prevent the cams from vibrating to the open position during ground operation and flight. However, there are two possible means by which the cargo door could open while in flight. Either, the latching mechanisms were forced open electrically through the lock sectors after the door was secured, or the door was not properly latched and locked before departure. Then the door opened when the pressurization loads reached a point that the latches could not hold.

The NTSB learned that in Flight 811's case, the aircraft had experienced intermittent malfunctions of its forward cargo door in the months prior to the accident. Based on this, the NTSB concluded in its April 1990 report that these malfunctions had damaged the door locking mechanism in a manner which caused the door to show a latched and locked indication, without being fully latched and locked. Thus, the NTSB attributed the accident to human error by the ground crew. Based on this hypothesis of in-service damage, the NTSB also faulted the airline for improper maintenance and inspection due to its failure to identify the damaged locking mechanism. Focusing on damage to the door and maintenance procedures, the NTSB ultimately concluded that the accident was preventable human error, and not a problem inherent in the design or function of the aircraft's cargo door.

Personal investigation and later developments

Lee Campbell was one of the casualties on Flight 811, a native New Zealander returning home. After his death, his parents Kevin and Susan Campbell investigated the cause of the decompression independently of the NTSB. The Campbells' investigation led them to conclude that the cause of the incident was not human error but instead the combination of an electrical problem and an inadequate design of the aircraft's cargo door latching mechanism. They later presented their findings to the safety board.

The Boeing 747 was designed with an outward-hinging door, unlike a plug door which opens inward and jams against its frame as the pressure drops outside, making it impossible to accidentally open at high altitude. The outward-swinging door increases the cargo capacity, but it requires a strong locking mechanism to keep it closed. Deficiencies in the design of wide-body aircraft cargo doors were known since the early 1970s from flaws in the DC-10 cargo door. These problems were not fully addressed by the aircraft industry or the NTSB, despite the warnings and deaths from the DC-10 incidents and Boeing attempts to solve the problems in the 1970s.

The 747's cargo door used a series of electrically operated latch cams into which the door-edge latch pins closed. The cams then rotated into a closed position, holding the door closed. A series of L-shaped arms (called locking sectors) were actuated by the final manual moving of a lever to close the door; these were designed to reinforce the unpowered latch cams and prevent them from rotating into an unlocked position. The locking sectors were made out of aluminum and were too thin a gauge to be able to keep the latch cams from moving into the unlocked position against the power of the door motors. Electrical switches cut electrical power to the cargo door when the outer handle was closed; but if one of those were faulty, the motors could still draw power and rotate the latch cam to the open position. The same event could happen if frayed wires were able to power the cam-motor, even if the circuit power was cut by the safety switch.

As early as 1975, Boeing realized that the aluminum locking sectors were too thin a gauge to be effective and recommended that the airlines add doublers to the locking sectors. After the 1987 Pan Am incident, Boeing issued a Service Bulletin notifying operators to replace the aluminum locking sectors with steel locking sectors, and to carry out various inspections. In the United States, the FAA mandated this service by means of an Airworthiness Directive (AD) and gave U.S. airlines 18 to 24 months to comply with it. After the Flight 811 incident, the FAA shortened the time to 30 days.

Two halves of the Flight 811 cargo door were recovered from the Pacific Ocean from 14,100 feet (4,300 m) below the ocean surface—on September 26, 1990 and October 1, 1990. The cargo door had fractured lengthwise across the center. Recovery crews reported that no other debris or evidence of human remains had been discovered. The NTSB inspected the cargo door and determined that the condition of the locking mechanism did not support its original conclusions.

Additionally, in 1991, an incident occurred at New York's John F. Kennedy International Airport involving the malfunction of a United Airlines Boeing 747 cargo door. At the time, United Airlines' maintenance staff were investigating the cause of a circuit breaker trip. In the process of diagnosing the cause, an inadvertent operation of the electric door latch mechanism caused the cargo door to open spontaneously despite being closed. An inspection of the door's electrical wiring discovered insulation breaches, and isolating certain electrical wires allowed the door to operate normally again. The lock sectors, latch cams, and latch pins on the door were inspected, and did not show signs of damage of the type predicted by the NTSB's original hypothesis.

Final conclusions

Based on developments after it issued its original report, NTSB issued a superseding accident report on March 18, 1992. In its superseding report, the NTSB determined that the probable cause of the accident was the sudden opening of the cargo door, which was attributed to improper wiring and deficiencies in the door's design. It appeared in this case that a short circuit in the aging plane caused an uncommanded rotation of the latch cams, which forced the weak locking sectors to distort and allow the rotation, thus enabling the pressure differential and aerodynamic forces to blow the door off the fuselage, ripping away the hinge fixing structure, the cabin floor and side fuselage skin, causing the massive explosive decompression.

Outcomes

The NTSB issued a recommendation for all 747-100s in service at the time to replace their cargo door latching mechanisms with new, redesigned locks. A sub-recommendation suggested replacing all outward-opening doors with inward-opening doors, which cannot open in flight due to the pressure differential. No similar fatality-causing accidents have officially occurred on this aircraft type.

In 1989, the flight crew received the Secretary's Award for Heroism for their actions. The aircraft was successfully repaired, re-registered as N4724U in 1989, and returned to service with United Airlines in 1990. In 1997, the aircraft was registered with Air Dabia as C5-FBS and abandoned in 2001 during overhaul maintenance at Plattsburgh International Airport. In 2004 the aircraft was scrapped for spare parts.

Captain David Cronin died on October 4, 2010, aged 81.

Passenger John F. Stephenson would later die in a separate plane crash, when his light plane plummeted into a residential area of South-Eastern Melbourne in 2014.