United Airlines Flight 811 was a regularly scheduled international flight from Los Angeles to Sydney, with intermediate stops at Honolulu and Auckland. On February 24, 1989, the Boeing 747 serving the flight experienced a cargo-door failure in flight shortly after leaving Honolulu. The resulting explosive decompression blew out several rows of seats, killing nine passengers. The aircraft returned to Honolulu and landed without further incident.
In its report on the accident in April 1990, the NTSB asserted that it was not possible for a properly latched cargo door to have opened in mid-flight, and focused primarily on potential mishandling of the door by ground crew. It blamed the accident on in-service damage to the door locking mechanism. An alternative investigation by the parents of one of the victims focused instead on the design of the door latching mechanism and the electrical system that opens it. After the final report on the incident was issued, the cargo door was recovered by a deep-sea operation, and its condition was not consistent with the report. After another incident occurred on a 747 aircraft undergoing maintenance in 1991, the NTSB issued a superseding final report in March 1992 that attributed the accident to the electrical system malfunctioning and causing the door to open during flight, along with deficiencies in the door's latching design, as had been suggested by the independent family investigation.
Aircraft
The aircraft involved was a Boeing 747-122 (registration number N4713U). Its serial number was 19875 and it was the 89th 747 built. At the time of the accident, the aircraft had accumulated 58,814 total flight hours and 15,028 flight pressurization cycles, and had not been involved in any previous accidents.
On February 24, 1989, the aircraft was scheduled by United Airlines to operate as Flight 811 from Los Angeles International Airport in Los Angeles, California, to Sydney Airport in Mascot, New South Wales, Australia, with intermediate stops at Honolulu International Airport in Honolulu, Hawaii, and Auckland Airport in Auckland, New Zealand. Flight 811 operated without incident on the first leg of the flight from Los Angeles to Honolulu; the flight crew reported no difficulties upon arriving at Honolulu, where a crew change occurred.
After the accident, the aircraft was repaired and put back into service with United but was re-registered as N4724U. In 1997, the aircraft was taken out of service and passed on to Air Dabia as C5-FBS. Air Dabia ceased operations in 1998, and the aircraft was abandoned at Plattsburgh International Airport, where it was scrapped in June 2003.
Flight crew
Starting in Honolulu, Flight 811 was under Captain David M. Cronin (age 59). At the time of the accident, Cronin had logged around 28,000 flight hours, including roughly 1,600 hours in Boeing 747 aircraft. Flight 811 was Cronin's penultimate scheduled flight before his mandatory retirement.
The remaining flight crew consisted of First Officer Gregory Allen "Al" Slader (48), and Flight Engineer Randal Mark Thomas (46), and 15 flight attendants. The first officer and flight engineer had logged 14,500 flight hours and 20,000 flight hours, respectively.
Accident
Flight 811 took off from Honolulu International Airport at 01:52 local time, with 337 passengers and 18 crew members on board. During the climb, the crew made preparations to detour around thunderstorms along the plane's track; the captain anticipated turbulence and kept the passenger seatbelt sign lit.
The aircraft had been flying for 17 minutes. As it was passing from 22,000 to 23,000 feet (6,700 to 7,000 m), the flight crew heard a loud "thump", which shook the plane. About a second and a half later, the forward cargo door separated from the aircraft. It swung out with such force that it tore a massive hole in the fuselage. This caused the plane to slightly bank to the left. Pressure differentials and aerodynamic forces caused the cabin floor to cave in, and 10 seats (G and H of rows 8 through 12) were ejected from the cabin. All eight passengers occupying these seats were ejected from the aircraft, as was the passenger in seat 9F. Seats 8G and 12G were unoccupied. A gaping hole was left in the aircraft, through which a flight attendant, Mae Sapolu, in the business-class cabin, was almost blown out. Purser Laura Brentlinger hung on to the steps leading to the upper deck and was dangling from them when the decompression occurred. Passengers and crew members saw her clinging to a seat leg and were able to pull her back inside the cabin, although she was severely injured.
The pilots initially believed that a bomb had gone off inside the airliner, as this accident happened just two months after Pan Am Flight 103 was blown up over Lockerbie, Scotland. They began an emergency descent to reach an altitude where the air was breathable while also performing a 180° left turn to fly back to Honolulu. The explosion damaged components of the on-board emergency oxygen supply system, as it was primarily located in the forward cargo sidewall area, just aft of the cargo door.
The debris ejected from the aircraft during the explosive decompression damaged the Number 3 and 4 engines. Engine 3 was experiencing heavy vibration, no N1 tachometer reading, and a low exhaust-gas temperature (EGT) and engine-pressure ratio, so the crew shut it down. At 02:20, an emergency was declared, and the crew began dumping fuel to reduce the aircraft's landing weight. The N1 reading of engine number 4 soon fell to almost zero, its EGT reading was high, and it was emitting flames, so the pilots shut it down as well. Some of the explosively ejected debris damaged the right wing's leading edge, dented the horizontal stabilizer on that side, and damaged the vertical stabilizer.
During the descent, Captain Cronin ordered Flight Engineer Thomas to tell the flight attendants to prepare for an emergency landing, but Thomas could not contact them through the intercom. Thomas asked the captain for permission to go down to find out what was happening, and Cronin agreed. Thomas saw severe damage immediately upon leaving the cockpit; the aircraft skin was peeled off in some areas on the upper deck, revealing the frames and stringers. As Thomas went down to the lower deck, the magnitude of the damage became apparent as he saw the large hole in the side of the cabin. Thomas returned to the cockpit and reported that a large section of the fuselage was open aft of the Number 1 exit door. Thomas concluded that it was probably a bomb.
As the airliner neared the airport, the landing gear was extended, but the flaps could only be partially deployed as a result of damage sustained following the decompression. This necessitated a higher-than-normal landing speed around 190–200 knots (220–230 mph; 350–370 km/h). Despite these factors, Captain Cronin was able to bring the aircraft to a halt without overrunning the runway. About 14 minutes had elapsed since the emergency was declared. All the remaining passengers and flight attendants evacuated the aircraft in less than 45 seconds. Every flight attendant suffered some injury during the evacuation, ranging from scratches to a dislocated shoulder.
Despite extensive air and sea searches, no remains of the nine victims lost in flight were found at sea. Small body fragments and pieces of clothing were found in the Number 3 engine, indicating that at least one victim ejected from the fuselage was ingested by the engine, but whether the fragments were from one or more victims was not known.
Investigation
NTSB initial investigation
The National Transportation Safety Board (NTSB) immediately commenced an investigation into the accident. An extensive aerial and surface search of the ocean had initially failed to locate the aircraft's cargo door. The NTSB proceeded with its investigation, without the cargo door to inspect, issuing a final report on April 16, 1990.
The investigation relied heavily on circumstantial evidence, including prior incidents involving cargo doors. On March 10, 1987, Pan Am Flight 125, another Boeing 747, outbound from London Heathrow Airport, encountered pressurization problems at 20,000 feet (6,100 m), causing the crew to abort the flight and return to the airport. After that aircraft landed safely back at London Heathrow Airport, the aircraft's cargo door was found to be ajar by about 1.5 inches (40 mm) along its ventral edge. When the aircraft was examined further, all of the door's locking arms were found to be either damaged or entirely sheared off. Boeing initially attributed this to mishandling by ground crew. To test this theory, Boeing instructed 747 operators to shut and lock the cargo door with the external handle and then activate the door-open switch with the handle still in the locked position. Nothing should have happened since the S-2 switch was designed to deactivate the door motors if the handle was locked. Some airlines reported that the door motors did indeed begin running; however, they attempted to force the door open against the locking sectors and caused damage to the mechanism.
Based on the evidence available and the attribution of prior cargo door malfunctions to damage caused by ground crew mishandling, the NTSB's investigative findings were rooted in the supposition that a properly latched and locked 747 cargo door could not open in flight:
There are no reasonable means by which the door locking and latching mechanisms could open mechanically in flight from a properly closed and locked position. If the lock sectors were in proper condition and were properly situated over the closed latch cams, the lock sectors had sufficient strength to prevent the cams from vibrating to the open position during ground operation and flight. Nonetheless, there are two possible means by which the cargo door could open while in flight. Either the latching mechanisms were forced open electrically through the lock sectors after the door was secured, or the door was not properly latched and locked before departure. Then, the door opened when the pressurization loads reached a point that the latches could not hold.
The NTSB learned that in N4713U's case, the aircraft had experienced intermittent malfunctions of its forward cargo door in the months before the accident. Based on this information and the presumption of in-service damage, the NTSB concluded in its April 1990 report that these malfunctions had damaged the door locking mechanism, in a way that caused the door to show a latched and locked indication without being fully latched and locked. The report criticized the component design; it also criticized the airline for improper maintenance and inspection and thus failing to identify locking mechanism damage.
Personal investigation and later developments
Lee Campbell, a New Zealander returning home, was one of the fatalities on Flight 811. After his death, his parents Kevin (an engineer) and Susan Campbell investigated the case using documents obtained from the NTSB. The Campbells' investigation led them to conclude that the cause of the accident was not human error but rather the combination of an electrical problem and an inadequate design of the aircraft's cargo door-latching mechanism. They later presented their theory to the safety board.
The Boeing 747 was designed with an outward-hinging cargo door, unlike a plug door, which opens inward and jams against its frame when closed as the pressure drops outside in flight, making accidental opening at high altitude impossible. The outward-swinging door increases the aircraft's available cargo capacity (less room inside the fuselage must be kept clear to accommodate the door's range of motion) but requires a strong locking mechanism to keep it closed. Deficiencies in the design of wide-body aircraft cargo doors have been known since the early 1970s due to flaws in the DC-10 cargo door. These problems were not fully addressed by the aircraft industry or the FAA, despite the warnings and deaths from the DC-10's cargo door-related accidents.
The 747's cargo door used a series of electrically operated latch cams into which the door-edge latch pins closed. The cams then rotated into a closed position, holding the door closed. A series of L-shaped arms (called locking sectors) were actuated by the final manual movement of a lever to close the door; these were designed to reinforce the unpowered latch cams and prevent them from rotating into an unlocked position. The locking sectors were made out of aluminum, however, and they were too thin to keep the latch cams from moving into the unlocked position against the power of the door motors. Electrical switches cut electrical power to the cargo door when the outer handle was closed; if one was faulty, the motors could still draw power and rotate the latch cam to the open position. The same event could happen if frayed wires could power the cam motor, even if the safety switch cut the circuit power.