On February 24, 1989 United Airlines Flight 811, a Boeing 747-122, N4713U, took off from Honolulu (HNL) at 0133 local time, bound for Sydney, Australia, with an intermediate stop at Auckland, New Zealand. The initial climb passed through an area of thunderstorms, so the captain elected to keep the seat belt sign on. As the aircraft was climbing, between 22,000 and 23,000 feet, explosive decompression was experienced. An emergency was declared at approximately 0220 HST. The captain initiated a 180-degree left turn to avoid a thunderstorm and proceeded toward HNL. The forward lower lobe cargo door had opened in flight, taking with it a large portion of the forward right side of the cabin fuselage. The starboard side engines were damaged and had to be shut down. Parts of the leading and trailing edge flaps where also damaged resulting in the crew electing to use only 10-degrees trailing edge flaps for landing (a non-normal configuration). This resulted in the aircraft having to land at a higher speed than it would under normal conditions. The aircraft was cleared to land at HNL runway 8L. At 0234 HST, Honolulu tower was notified by the flight crew that the airplane was stopped and an emergency evacuation had commenced on the runway. During the decompression, nine passengers had been ejected from the airplane and lost at sea.

View United Airlines Flight 811 Accident Animation below:

Cargo Door Description and Operation

The forward lower lobe cargo door is located on the lower starboard side of the fuselage. The door opening is approximately 110 inches wide by 99 inches high, as measured along the fuselage.

Electrical power for operation of the cargo door switches and actuators is supplied from the ground handling bus, which is powered by either external power or the Auxiliary Power Unit (APU). The engine generators cannot provide power to the ground handling bus. APU generator electrical power to the ground handling bus is interrupted when an engine generator is brought on-line after engine start. The APU generator can be reengaged by the flight crew if necessary on the ground to power the ground handling bus. The air/ground safety relay automatically disconnects the APU generator from the ground handling bus, if it is energized, when the airplane becomes airborne and the air/ground relay senses that the airplane is off the ground.

The cargo door and its associated hardware are designed to carry circumferential (hoop) loads arising from pressurization of the airplane. These loads are transmitted from the piano hinge at the top of the door, through the door itself, and into the eight latches located along the bottom of the door. The eight latches consist of eight latch pins attached to the lower sill and eight latch cams attached to the bottom of the door. The cargo door also has two mid-span latches located along the fore and aft sides of the door. These mid-span latches primarily serve to keep the sides of the door aligned with the fuselage. There are also four door stops which limit inward movement of the door. There are two pull-in hooks located on the fore and aft lower portion of the door, with pull-in hook pins on the sides of the door frame. There is a master latch lock handle installed on the exterior of the door, which is operated manually. The master latch lock handle simultaneously controls the operation of the latch sectors and the two pressure relief doors located on the cargo door.

The door has three electrical actuators for opening/closing and latching of the door. One actuator (main actuator) moves the door from the fully open position to the near closed position and vice versa. A second actuator (pull-in hook actuator) moves the pull-in hooks to the closed or open position. A third actuator (latch actuator) rotates the latch cams from the unlatched position to the latched position and vice versa. The latch actuator has an internal clutch which slips to limit the torque output of the actuator.

Normally, the cargo doors are operated electrically by means of a switch located on the exterior of the fuselage, just forward of the door opening, or by a switch located inside the cargo compartment adjacent to the door. The switch controls the opening, closing, and latching of the door. If at any time the switch is released, the switch will return to the neutral position, power is removed from all actuators, and movement of the actuator ceases.

In order to close the cargo door, the door switch is held to the "closed" position, energizing the main actuator to move the door to the closed position. After the door has reached the near closed position, the hook position switch transfers the electrical power to the pull-in hook actuator. The pull-in hook actuator brings the door to the fully closed position by rotating the pull-in hooks on the forward and aft edge of the cargo door around pull-in hook pins affixed on the sides of the door frame. When the pull-in hooks reach their fully closed position, the hook-closed switch transfers electrical power to the latch actuator. The latch actuator rotates the eight latch cams mounted on the lower portion of the cargo door around eight latch pins attached to the lower door frame sill. The latch actuator also rotates two mid-span latches located on the sides of the cargo door around two mid-span latch pins located on the sides of the door frame. When the eight latch cams and two mid-span cams reach their fully closed position, electrical power is removed from the latch actuator by the latch closed switch. This completes the electrically powered portion of the door closing operation.

The final securing operation is the movement of the lock sectors across the eight lower latch cams by movement of the master latch lock handle to the closed position (see Figures 1 and 2). The lock sectors are manually moved in place across the open mouth of each of the eight lower latch cams through mechanical linkages to the master latch lock handle. Two pressure relief doors are also mechanically linked to the master latch lock handle. (See Lock Sector Sketch). The pressure relief doors are designed to relieve any residual pressure differential before the cargo doors are opened after landing, and to prevent pressurization of the airplane should the airplane depart with the cargo doors not fully secured. The mechanical linkage is such that when the pressure relief doors are closed, the lock sectors are covering the open mouths of the lower latch cams, thus providing an indirect means of noting the position of the lock sectors. Improper positioning of the latch cams would interfere with the motion of the lock sectors, and provide an indication that the door is not properly closed.

(Looking Forward, typical 8 places)

Figure 1: Latch Cam and Lock Sector "Open" and "Unlocked"

Figure 2: Latch Cam and Lock Sector "Closed" and "Locked"

This final procedure also actuates the S2 master latch lock switch, removing electrical control power from the opening and closing control circuits, and also extinguishes the cockpit cargo door warning light through a switch located on one of the pressure relief doors. Opening the cargo door is accomplished by reversing the described procedure.

The cargo door has eight view ports located beneath the latch cams for direct viewing of the position of the cams by means of alignment stripes. These eight ports were intended to provide ground servicing personnel with the capability of determining the correct position of the locking and latching components by verifying their position, using the alignment stripes.

Closing the door manually is accomplished through the same sequence of actions, without electrical power. The door actuator mechanisms are manually driven to a closed and latched position by the use of a one-half-inch socket driver. The door can also be opened manually with the use of the socket driver. There are separate socket drives for the door raising/lowering mechanisms, the pull-in hooks, and the latches.

N4713U after emergency landing at HNL

Before Recovery of the Door

Before recovery of the cargo door, the NTSB believed that the door locking mechanism had sustained damage in service prior to the accident flight, to the extent that the door could have been closed, and appeared to have been locked, when in fact the door was not fully latched. This belief was expressed in the original report that was adopted by the NTSB on April 16, 1990. 

Door Recovery

On September 14, 1990, the recovery ship Laney Chouest sailed from Pearl Harbor, Hawaii, with the manned deep sea submersible Sea Cliff. NTSB, FAA, Boeing and UAL engineering staff assisted the recovery team aboard the Laney Chouest. Previous U.S. Navy scanning had identified the debris field.

The lower portion of the cargo door was recovered first, and on October 1, 1990, the upper portion was recovered during the Sea Cliff's seventh dive. The ship returned to Pearl Harbor, and the retrieved door portions were removed and examined before being shipped to Seattle, Washington for detailed examinations.

After Recovery of the Door

After recovery of the door, the evidence indicated that the latch cams had been back driven from the closed position, into a nearly open position, after the door had been closed and locked. The latch cams had been driven into the lock sectors, which subsequently deformed and allowed the latch cams to rotate to an open position.

Possibility of Electrical Malfunction

Due to lack of physical evidence, the NTSB was unable to conclude that an electrical short caused the cargo door actuator to move the latch cams to the nearly open position, allowing the door to separate when the cabin pressure exceeded the load carrying capability of the door latches. Neither could this possibility be eliminated. A momentary actuation of the door open switch by someone on the ground, in the presence of a faulty S2 switch, could also have caused the latches to open and deform the closed lock sectors. However, no evidence had been found that someone actuated the switch after the door was initially closed and locked.

There are two animations of the door latching system, one, a more general overview (Cargo Door Overview animation), and the other, a more detailed view of the latching/locking mechanism and the door failure (Door Latch animation). Each video animation is available below:

The NTSB concluded that it was not possible for the cargo door to have opened electrically at the time of the loss of the door. There was no power to the ground handling bus to power the actuators, even if there had been an electrical short. The electrical operation of the latch actuators from the fully closed and locked position most likely occurred before the engines were started when the ground handling bus was powered. Once the engines are started, the possibility of an electrical short decreases significantly because the ground handling bus is disengaged from the APU. There was no evidence that the flight crew reengaged the ground handling bus, nor was there evidence that ground cargo loading personnel momentarily commanded the door open following closure.

An incident involving a UAL Boeing 747 at JFK Airport on June 13, 1991, confirmed that electrical short circuits in the cargo door wiring could cause the door to open. In this case, the short circuit was found to be in the fuselage-to-cargo door wiring bundle, covered by a flexible conduit. Although N4713U did not have a flexible conduit installed at the forward door position, its wiring was routed over the top of the door hinge where exposure to damage could occur. That portion of the wiring from N4713U was not recovered from the sea. It was believed by the investigators that the wires located at the door hinge area were more susceptible to in-service damage from movement during the open/close cycle, as compared with the wires mounted on the door that are normally static.

The investigators also determined that there was another reason why the opening of the door could not have been caused by electrical actuation shortly before the explosive decompression. Because the door carries the structural loads (hoop stresses) through its hinge and latches, the latch cams would be heavily loaded against the latch pins when the airplane was pressurized to the 6.5 psi differential pressure that was calculated to have been present at the time of the decompression. In that case, the investigation concluded that the torque limiter within the actuator would probably slip well before the actuator could achieve the torque necessary to drive the cams open against the friction produced by the high bearing stresses resulting from pressurization.

Previous In-service Incident

Prior to the UAL 811 accident, a Pan Am 747 experienced a similar door malfunction in March, 1987. Following departure from Heathrow International Airport in London, the Pan Am flight experienced a pressurization problem due to the forward lower lobe cargo door having partially opened in flight. The flight returned to Heathrow, and it was subsequently learned that the door lock sectors had been deformed by an "open" command. Since the door had been closed and locked for this flight using manual procedures, it was believed by the investigators that ground loading personnel most likely had inadvertently back driven the open linkage, thereby deforming the lock sectors.

As a result of the Pan Am incident, Airworthiness Directive (AD) AD 88-12-04 (July 1, 1988) was issued, which required, among other things, modifications to the lock sectors. The terminating action for AD 88-12-04 called for the reinforcing of the lock sectors with steel doublers to prevent the latch cams from being driven to the open position, either manually or electrically, with the lock sectors in the locked position. A review of maintenance records for N4713U revealed that this airplane had been scheduled for installation of the terminating action in April 1989.

The entire NTSB report on this accident is available at the following link: NTSB Report

Back to top

The NTSB issued 26 safety findings. The findings are excerpted from the official accident report, and are available at the following link: NTSB Findings

The NTSB issued the following probable cause:

The NTSB determined that the probable cause of this accident was the sudden opening of the forward lower lobe cargo door in flight and the subsequent explosive decompression. The door opening was attributed to a faulty switch or wiring in the door control system which permitted electrical actuation of the door latches toward the unlatched position after initial door closure and before takeoff. Contributing to the cause of the accident was a deficiency in the design of the cargo door locking mechanisms, which made them susceptible to deformation, allowing the door to become unlatched after being properly latched and locked. Also contributing to the accident was a lack of timely corrective actions by Boeing and the FAA following a 1987 cargo door opening incident on a Pan Am B-747.

Back to top

The NTSB issued a number of recommendations covering a number of subjects. Four of the major recommendations were:

• Require that the electrical actuating systems for non-plug cargo doors on transport category aircraft provide for the removal of all electrical power from circuits on the door after closure (except for any indicating circuit power necessary to provide positive indication that the door is properly latched and locked) to eliminate the possibility of uncommanded actuator movements caused by wiring short circuits.
• Issue an Airworthiness Directive (AD) to require that the manual drive units and electrical actuators for Boeing 747 cargo doors have torque limiting devices to ensure that the lock sectors, modified per AD-88-12-04, cannot be overridden during mechanical or electrical operation of the latch cams.
• Issue an AD for non-plug cargo doors on all transport category airplanes requiring the installation of positive indicators to ground personnel and flight crews confirming the actual position of both the latch cams and locks, independently.
• Require that fail-safe design considerations for non-plug cargo doors on present and future transport category airplanes account for conceivable human errors in addition to electrical and mechanical malfunctions.

The complete text of the NTSB recommendations is available at the following link: NTSB Recommendations

Back to top

14 CFR 25.783 (e) (f), Amendment 25-15. The complete text of this regulation is available at the following link:  14 CFR 25.783

Back to top

The Turk Hava DC-10 accident in Paris, which occurred in 1974, was determined to have been the result of an improper closure of an aft, outward opening cargo door, resulting in failure of the door locking mechanism, an explosive decompression, and cabin floor failure. The airplane crashed, killing all 346 passengers and crew. The Turk Hava accident and a nearly identical American Airlines DC-10 incident three years earlier were both attributed to errors in door closure by ground personnel. Further, an incident on a Pan Am 747, on departure from London in 1987, was believed to have been the result of door closure errors. As a result, following the United Flight 811 accident, much of the early focus of the investigation was aimed at determining whether or not errors by ground personnel had also contributed to, or caused, the failure that led to the loss of the 747-cargo door. It was not until the door was finally recovered from the ocean floor, approximately one year after the accident, that evidence from the wreckage positively identified a powered door opening event had occurred following door closure, and that ground personnel had not been responsible for causing damage to the door locking mechanism. The three previous incidents and accidents involving both the DC-10 and the 747, all determined to have been the result of ground closure errors, caused early investigation efforts to focus on the possibility of human error rather than door malfunctions.

Back to top

• The lock sectors, which were originally intended to provide tactile feedback to ground crews regarding proper positioning of the latch cams. It was not envisioned that they would also provide a fail safe function in the event of an inadvertent power open command. Consequently, the lock sectors were initially made of a weaker material (aluminum) than the latch cams (steel). When the latch actuators inadvertently received power, the latch cams deformed the lock sectors and allowed movement of the latch cams toward the unlocked position.
• Cargo door wiring routed over the top of the door hinge where exposure to damage could occur.
• A malfunctioning S2 switch that is intended to remove power to the system when the master latch lock handle is moved to the closed position.

Back to top

• Power would be isolated from the door when the door is locked.
• The door lock sectors would never be required to protect the door against electrical back drive forces.

Back to top

On March 10, 1987, a Pan American Airways B-747-122, N740PA, operating as Flight 125 from London to New York, experienced an incident involving the forward cargo door. Investigators determined that the flight crew experienced pressurization problems as the airplane was climbing through about 20,000 feet. The crew began a descent and the pressurization problem ceased about 15,000 feet. The crew began to climb again, but about 20,000 feet, the cabin altitude began to rise rapidly again. The flight returned to London.

When the airplane was examined on the ground, the forward cargo door was found open about 1-1/2 inches along the bottom with the latch cams unlatched and the master latch lock handle closed. The cockpit cargo door warning light was off.

According to investigators who examined the airplane, the cargo door had been closed manually, and the manual master latch lock handle was stowed, in turn closing the pressure relief doors and extinguishing the cockpit cargo door warning light. Subsequent investigation on N740PA revealed that the latch lock sectors had been deformed and would not restrain the latch cams from being driven open, either electrically or manually. It was concluded by the investigation that ground service personnel may have inadvertently back driven (opened) the latches manually after the door had been closed and locked.

Back to top

Following the Turk Hava DC-10 accident in Paris, a number of regulatory changes were issued to correct problems in cargo door locking mechanisms on many different models of large transport airplanes. These changes were applied to this Boeing Model 747 prior to the UAL 811 accident. As a result, no specific regulatory changes resulted from the UAL 811 accident. However, perceived shortcomings in the application of the regulatory criteria resulted in AD actions to correct uniquely identified problems in the 747 door design.

Information on the DC-10 Paris accident and the resulting regulatory and policy changes concerning cargo door standards is available elsewhere in this Lessons Learned Library.

Back to top

On March 31, 1989, the FAA issued airworthiness directive 89-05-54. This AD superseded AD 88-12-04 and required certain procedures to be accomplished when operating the cargo doors. The AD also accelerated the schedule for terminating action to place steel doublers on the lock sectors, and it reinstituted the procedures for using the eight view ports to verify the position of the latch cams, after the door is latched and locked.

AD 89-05-54 was superseded by AD 90-09-06 on May 29, 1990. AD 90-09-06 is available at the following link (AD 90-09-06)

Back to top

Airplane Life Cycle:

• Design / Manufacturing

Accident Threat Categories:

• Structural Failure
• Pressurization / Decompression Failures
• Lack of System Isolation / Segregation

Groupings:

• Automation

Accident Common Themes:

• Organizational Lapses
• Flawed Assumptions
• Pre-existing Failures

Back to top

Organizational Lapses

Prior to the UAL 811 accident, a Pan American Airlines 747 had experienced a similar inflight event. The investigation into that incident concluded that the door had been back driven in the open direction following closure, deforming the latch sectors and allowing the door to come open in flight. Since the door had been manually closed by ground personnel for this Pan Am flight, the investigation concluded that the back drive event may have been the result of an error by ground personnel during the closing process. Following the UAL 811 accident determination of probable cause, the previous conclusions relative to human error having been the cause of the Pan Am incident came into question.

Pre-existing Failures

The latent failure of the S2 switch, in combination with a hot short within a wiring harness, commanded activation of the latch actuator on the forward lower lobe cargo door.

Flawed Assumptions

The lock sectors were not intended to prevent the latch cams from rotating and "unlocking" the door but were intended to provide tactile feedback that the latch cams were properly positioned following door closure. It was assumed that the lock sectors would not be required to act as a failsafe mechanism and prevent rotation of the latch cams during a powered open command. A malfunction in the door electrical system caused the latch cams to rotate, deforming the lock sectors.

Back to top

• On March 3, 1974, a Turk Hava DC 10, Flight TK 981, crashed as a result of the aft, left cargo door having inadvertently opened in flight. The accompanying explosive decompression caused the aft cabin floor to collapse, severing control cables to the center engine and flight controls, and leading to a loss of control. The accident investigation concluded the accident was the result of deficient door design which contributed to the possibility of damage to the door locking system during closure.

See accident module

• On June 12, 1972, an American Airlines DC-10, outbound from Detroit while over Windsor-Locks, Ontario, experienced an aft cargo door failure resulting in a rapid decompression and cabin floor failure identical to the circumstances of the Turk Hava accident. A more lightly loaded cabin floor prevented the floor failure from being as severe as on the above referenced Turk Hava DC-10. The airplane remained partially controllable and successfully returned to Detroit.

Back to top

Technical Related Lessons:

The integrity and reliability of backup safety features should provide protection from all expected threat conditions. (Threat Category: Lack of System Isolation/Segregation)

• In the case of UAL 811, a combination of electrical failures allowed the forward lower lobe cargo door to be powered partially open after it had been closed and locked. The lock sectors, which were intended to prevent the latch cams from rotating and unlocking the door, were manufactured of aluminum, which was easily deformed by the steel latch cams when a powered open command was provided. The electrical malfunction that powered the door mechanism in the open direction caused failure of the latch sectors and prevented their function as "fail-safe" devices. Their failure to prevent rotation of the latch cams resulted in the door opening.

Common Theme Related Lessons:

It is essential that major service incidents are understood and resolved in a timely manner in order to avoid future incidents or accidents due to this same condition. (Common Theme: Organizational Lapses)

• In March of 1987, a Pan American Airlines 747 experienced a partial cargo door opening following takeoff from London. The airplane was able to successfully return to London. Investigators concluded that ground personnel may have inadvertently manually driven the door in the "open" direction, damaging the lock sectors. The investigators did not suspect that an electrical malfunction had caused a powered open command. The true nature of the failure may not have been understood when it occurred.

Back to Top