Terror In The Sky -- Flight 811 Lost A Cargo Door And Nine Lives -- Boeing Is Still Wrestling With Solutions And Settlements
Feb. 23, 1989. Midmorning.
The phone rings. Curt Christensen, a United Airlines flight attendant, is told to report by midnight to work the red-eye leg of Flight 811, Honolulu to Auckland. The Boeing 747 is scheduled to depart Honolulu International Airport at 01:30 hours.
Christensen is up for the trip. And why not? New Zealand, with its laid-back pace and gracious populace, is a favorite stopover, much preferred over someplace like intense Tokyo.
Christensen, 33, falls into his preflight routine: Pack. Go to the bank. Water the plants. Abstain from caffeine. At dusk he grabs a catnap, then gets to the airport at least a half-hour early.
In the old days, crew members never had their gear checked. But that changed after a disgruntled airline employee shot his former boss on a Pacific Southwest Airlines flight over Los Angeles, then cooly walked up to the cockpit and killed the pilots.
Guns. Explosives. Bombs. Things had changed a lot in the 11 years since Christensen began flying. He had worked at Pan Am for eight years before moving over to The Friendly Skies. He knew several of the 747 crew wiped out by a terrorist's handiwork over Lockerbie, Scotland.
Christensen no longer griped about queuing up with the passengers to get his bags inspected.
Today, from Sea-Tac and from every major airport in the world, flocks of 747s, Boeing's signature aircraft, will take to the air.
There are more than 830 747s flying, and most planes make one or two flights every 24 hours. Boeing's sprawling Everett plant delivers one new 747-400 into commercial service every five days. Sticker price: $150 million.
Just before each humped jetliner backs away from the airport gate, its massive cargo doors - swung out and up, gull-wing fashion - are tucked neatly back into the airplane's fuselage.
When the 747 was on the drawing boards in the late 1960s, Boeing officials had a choice: Make the cargo doors open out or in.
Inward-opening "plug doors," which wedge into the passageway as the plane pressurizes, certainly had a long history in commercial aviation. All doors, both cargo and passenger, on Boeing 707s and on the early versions of the 727 were plug type. Later, plug doors would be used exclusively on the ubiquitous 737 baby twinjet.
But the problem with the 747 was size. To make the most profitable use of a capacious cargo, a very large door was required. But a giant plug door implied heavy tracks and wide inside clearances.
A door that swung out and up, on the other hand, would be both relatively light and completely out of the way. The door would have to hold fast, of course, against enormous pressurization forces, but resourceful engineering could take care of that.
The outward-opening door quickly became the obvious selection, establishing a standard for an entire generation of jetliners that was to follow the 747, including the 767 and 757, the Airbus A300 and A310, and the McDonnell Douglas MD-10 and MD-11.
"Basically, it was economics," said Hal Sprogis, a veteran 747 pilot and safety consultant. "Plug doors are simple, trouble-free and clearly more failsafe in design, but they do not allow full use of cargo space."
Feb. 24, 1989. 00:00:00 hours
Chief purser Laura Brentlinger, a 17-year veteran, is running Flight 811's pre-flight briefing.
The plane, which set out from New York, stopped in Los Angeles and will go on from Auckland to Sydney, is a 19-year-old Boeing 747-100, the 89th jumbo jet off Boeing's Everett production line.
It has 10 passenger doors, five on each side of the fuselage, and, on its starboard-side belly, two large cargo doors, one forward, one aft. It holds 400 passengers in the standard three-class seating configuration used on international flights. This flight, with 337 passengers, is about three-quarters full.
Supervising a crew of 14 flight attendants, Brentlinger assigns Ed Lythgoe, Ricky Umehira, Mae Sapolo, Ilona Benoit, Richard Lamb and Sharol Preston, all veterans, to positions in the forward part of the cabin.
Christensen draws jump seat 5-right at the very rear of the cabin; he doesn't mind the assignment. The informality of serving the smokers, students and bargain travelers in tourist class beats the airs sometimes put up by customers occupying the more expensive seats in first class and business class.
Christensen completes a preflight inspection of passenger door 5-right and the aft closets and lavs. He strolls up the right aisle, glancing left and right for suspicious objects or packages in Rows 37 through 51.
He sees nothing out of the ordinary.
Christensen hustles forward, then up the spiral staircase to help Sharol Preston pamper folks who've paid a few hundred extra bucks to sit in the hump.
By the time they get done, all 337 passengers are on board. Christensen descends the staircase, steps lively down the right aisle. He takes no notice of the eight business-class passengers settling into the G and H seats in Rows 8 through 12, or of the middle-aged man in 9F.
His passengers in the cheap seats are waiting.
Gambling metaphors are rife in the aerospace industry; milestones are marked by "bet-the-company" decrees, key parts engineered to beat "10-to-the-minus-nine" odds. Translation: The chance a part will fail is supposedly one in a billion.
With the 747 cargo door, Boeing wagered its unassailable reputation that it could devise an elaborate system of electro-mechanical latches and locks that would always, always, always keep the plane's 9-foot-square, 800-pound cargo doors secure in flight.
Engineers knew that if a door failed under high pressure, an explosive decompression would result. In something akin to, but exponentially more violent than, a walloping truck-tire blowout, the door would explode away from the aircraft, tearing out huge chunks of the fuselage and cabin floor.
In "the sporty game," as insiders call the aircraft-making business, there is no arguing with success. And who has had more success than Boeing, builder of six out of 10 commercial jetliners flying? As the unwritten industry truism goes, "If it comes from Seattle, it can't be built any better."
Soon after the 747 entered commercial service in the early '70s, a vexing trend emerged. One by one, various complex mechanisms in the door began to fail: battered and bent locks, stripped clutches and motors, burned-out sensors and switches, jammed latches and locks, chronic glitches with the door's complicated system of sequential electronic controls.
One by one, Boeing addressed each problem.
"Almost every part of the door-operating system at one time or another has been the subject of service letters," says an industry official who investigates accidents. "In each case the company would come up with very narrow solutions without ever looking at the unit as a whole."
No one questioned that approach. The 10-to-the-minus-nine wager held; during the '70s and most of the '80s, on tens of thousands of flights, through countless opening and closing sequences, the door held fast.
United ramp serviceman Brian Kitaoka, a helicopter pilot and flight-school instructor, begins routinely securing the forward cargo door by flicking and holding down a simple toggle switch located in a small recess on the fuselage near the lower forward corner of the doorway.
As long as Kitaoka holds down the "open/close" toggle, 28 volts of electricity begin tripping a series of electrical relays, sensors and switching devices. This brings to life, in sequence, three 115-volt motors, called actuators:
Trip. Like a bird retracting a wing, the door-lift actuator steadily lowers the hefty door until its bottom edge reaches the fuselage. This takes 10-15 seconds.
Trip. Two U-shaped "pull-in hooks," one on each side of the door, engage pins on each side of the doorway; the hook actuator wraps the hooks around the pins, pulling the door snugly shut. This takes 1.5 seconds.
Trip. Eight C-shaped latches, evenly spaced like miniature claws along the bottom of the door, engage eight pins attached to the door sill; the latch actuator rotates the claws around the pins, securing the door. This takes another 1.5 seconds.
Once the last claw rotates into place, power automatically cuts off. Kitaoka releases the toggle, which springs to center, or neutral, position.
At this point he has two options: Lock the door - and simultaneously shut down the 28-volt power to the toggle - or reverse the entire sequence and open the door by flicking the toggle up.
Following the prescribed routine, Kitaoka reaches up to a palm-size handle jutting from the middle of the door and pushes it in. This action mechanically shuts two small ports (called pressure-relief doors) just above the handle, and simultaneously swings eight J-shaped aluminum bars (lock sectors) into place on top of the latches, sealing them closed.
With a flick of the wrist, Kitaoka has locked the door.
Thanks to clever engineering the worker has, in the same motion, accomplished two other important tasks.
As the pressure ports shut, a sensor/switch extinguishes the cargo-door warning light in the cockpit. At the same time - as the last of the eight locks swings into place - another sensor/switch in the lower, rear corner of the door cuts 28-volt power from the open/close toggle.
Only three minutes behind schedule, Flight 811 pushes back from Gate 7 and begins the long taxi to the Honolulu's reef runway.
In the cockpit, second officer Randall "Mark" Thomas, running through his pre-flight checklist, notes that the cargo-door warning light is extinguished.
In the cabin, passengers don eye shades, wrap themselves in blankets and nod off, despite having to keep their seats upright for takeoff. All appears to be routine.
Pilots swear by Boeing airplanes.
Its commercial jetliners, in particular, are known to be durable and forgiving, meaning they tend to remain airworthy even in cases of egregious errors by the maintenance crew or the pilots.
But pilots also curse Boeing's long history of summarily refuting any suggestion of a flaw in the aircraft design contributing to an accident, while rarely hesitating to point to "pilot error."
It's not just sour grapes. Air-safety advocates point to case study after case study in which arcane safety issues, cast as being too complicated for the average citizen to understand, invariably reflect Boeing assumptions, Boeing technical analyses and Boeing political muscle.
These issues increasingly touch on the federal authorities certifying as safe the sophisticated electronic gadgetry created to replace old-style mechanical controls.
Last May, after a Lauda Air 767-300ER crashed near Thailand, killing all 223 on board, Boeing asserted that the pilots should have been able to control the plane, even if an electronically controlled braking mechanism, called a thrust reverser, deployed during the flight.
For weeks afterward, Boeing public-relations officers said little about the reversers, but never missed a chance to point out that a bomb, a shipment of combustible wristwatches and other possible causes had not been ruled out.
Later it was revealed that Boeing never tested what would happen if a thrust reverser deployed at high speed; it turns out a modern twinjet like the 767 flips into a supersonic nose dive almost immediately and starts breaking up in less than 30 seconds, even before hitting the ground.
Boeing officials, when pressed, concede that they do not fully understand how a flaw in a safety device on the reversers installed on more than 1,600 late-model Boeing 767s, 747s, 757s and 737s could inadvertently deploy the reverser, as apparently happened on the Lauda plane.
And yet company officials convinced the FAA that only 58 planes, those exactly like the ill-fated Lauda aircraft, should have the suspect part modified.
"The FAA for a long time now has been mostly a public-relations tool for industry, instead of a consumer-protections advocate for the public," says? Robert Besco, a former airline pilot and safety consultant from Dallas.
With the 747 airborne for 10 minutes, most passengers are already zonked out; the "fasten seatbelt" light extinguishes.
Christensen unbuckles and heads up right aisle to the aft service center. Tina Blundy, Jean Nakayama and Darrell Blankenship are already there, fussing with the liquor carts. John Horita is below deck, in the cargo-hold galley, sending up more carts.
Up front, Brentlinger, Umehira and Lythgoe congregate at foot of the staircase, near door 1-right.
Lythgoe notices a shortage of champagne. Benoit and Sapolo are already serving drinks to passengers in business class. Lamb is below deck prepping meals in the forward galley.
A young man in 14G, seated next to a blond woman in a white dress in 14H, gets up, goes aft, heading for the center cabin lavs.
Climbing at 500-plus miles per hour, the plane passes 22,000 feet. Though Flight 811 is now slightly higher than the summit of Mount McKinley, cabin pressure is the same as in a car crossing Stevens Pass.
Compressed air, drawn from the powerful jet engines, exert 6.5 pounds of force on each square inch of the plane's walls. The aircraft swells and elongates, like a sausage-shaped balloon. Measuring 110 by 99 inches, the forward cargo door restrains 70,785 pounds of force, the weight of a small herd of elephants.
In the right aisle behind the last row in business class, Sapolo is hunting down a Diet Coke. In the first-class service bay, Lythgoe is on the phone asking Lamb to send up more champagne.
In the aft service center, there is the usual chatter. Christensen collects some ice and orange juice from the counter and places it on his cart.
If there is a scapegoat in the long history of problems with 747 cargo doors, official documents point to heavy-handed ramp workers.
Over the years, Boeing has convinced the FAA that ramp workers were responsible for locks found battered, bent and jammed on scores of 747 cargo doors.
This explanation centers on manual operation of cargo doors, a procedure necessary when the electronic controls are inoperative. The electrical and manual operating sequences are identical, except that a wrench-wielding worker, not electricity, rotates the actuators.
Boeing contends that workers would close and latch the door manually with a wrench, set the locks in place by depressing the lock handle, and then, as a final step, wind the latch actuator in reverse - toward the open position - to confirm that the latches were bumping up snugly against the locks.
Ramp workers have always denied this, and no hard evidence has surfaced that this highly unusual procedure ever was widely practiced.
Nonetheless, manual backwinding became a theory that has turned up as a central theme in the official explanations for the two documented cases of a 747 cargo door opening in flight.
The first dates to March 10, 1987, on Pan Am Flight 125, London to San Francisco. The electrical system was not working on the forward cargo door, so a ramp worker shut and latched the door manually, using a speed wrench, then locked it by depressing the lock handle.
Shortly after takeoff, the pilot found he was unable to pressurize the cabin, so he returned to London, where the worker discovered that the forward cargo door he had secured only a short time earlier was open 1.5 inches. The door was reclosed and the plane sent on its way. A closer inspection in San Francisco revealed severe damage to the locks.
This seemingly mundane incident raised a host of red flags back at Boeing's Seattle headquarters.
In 1975, Boeing had advised airlines to install an aluminum extension on the locks to make them easier to close. Now it appeared the locks were too weak to do their job of sealing the latches in the fully closed position.
Suddenly a loud thump stuns all on board. "What the hell was that?" asks Capt. David Cronin; 1.8 seconds later comes the shock of a tremendous boom.
In one instant, 11 million pounds of force - to this point distributed evenly on each square inch of the aircraft's interior - becomes a hurricane of air gushing out of Flight 811's forward cargo door.
The door heaves away, peeling open a yawning cavity alongside Rows 9, 10, 11 and 12 on the starboard side.
In the blink of an eye, Seats G and H, in Rows 8 through 12, vanish along with a chunk of the floor, the right aisle and eight passengers. Gone, too, from aisle Seat 9F is Anthony Fallon, 49, of Long Beach, Calif.
Seat 9F is now mounted on the edge of a wind-blown precipice, unbuckled seatbelt flapping, right arm rest bent at a severe angle, pointing eerily to a black hole that has just swallowed Fallon and his wife Barbara, Harry and Susan Craig, Lee Campbell, Dr. John Crawford, John Swan, Rose Harley and Mary Handley-Desso.
In Wellington, New Zealand, Susan Campbell is startled out of a sound sleep by a strange foreboding. After her husband, Kevin, calms her, the couple go back to sleep.
Although Boeing blamed the ramp worker for backwinding the door open on Pan Am Flight 125, the company also went about conducting lab tests that revealed a stray electrical signal could do the same thing, only much faster.
Boeing concluded that the worker must have closed, latched and locked the door properly, but subsequently backwound the latches open past the locks that had been severely weakened by previous manual backwinding.
However, to fully open the locks, the worker, after securing the door, would have had to backwind his wrench more than 90 full turns. A stray signal could do the same thing in 1.5 seconds. Even so, the worker, who denied backwinding the latches, got the blame.
An inspection of Pan Am's 747 fleet by the airline revealed a pattern of damaged locks. This suggested a chronic pattern of backwinding the latches against locks getting progressively weaker. More than 300 latches were inspected. On 10 doors the locked latches could be partly opened, and on five other doors, the locks were so battered that the latches could be backwound fully open.
About one month after the Pan Am incident, Boeing alerted airlines worldwide that opening of a cargo door in flight "could result in rapid decompression . . . resulting in collapse of the passenger cabin floor and the possible damage to airplane electrical and hydraulic systems." That warning was accompanied by a call for airlines to install special steel braces on aluminum locks now known to be dangerously weak.
Pan Am did not wait for the steel braces to be mass-produced; it borrowed a copy of the design from Boeing, fabricated its own braces and quickly installed them on its 747 fleet.
Meanwhile, the FAA assigned a low priority to the matter, opening up a months-long process called "notice of proposed rule-making," during which the airlines asked for up to two years to make the $2,000-per-door upgrade. The FAA obliged.
On Nov. 28, 1988, the United jet was on the ground in San Francisco for several days undergoing a planned major tuneup. An FAA order to install the steel reinforcement was in effect, but with the deadline more than a year off. So the weak locks were left unreinforced on a plane destined for an ill-fated trip.
Thus events were set into motion that would lead to the second cargo-door episode - United Flight 811 - and trigger a long-running National Transportation Safety Board investigation, a probe that after three years is about to climax next month.
At the moment of the explosion, Christensen is facing forward, hands empty, standing partly in the aft service center. He collapses into the right aisle.
In that instant, his senses record an indelible nightmare: "Immediately the air filled with a hazy smoke and flying debris. I felt a cold wind and sucking, if you will, but it wasn't a sucking. It was like being in the middle of a huge cannon blast, a blast of cold air. There was gray, swirling smoke and debris flying everywhere.
"Out of the corner of my eye, as I was being thrown down, I watched ceiling panels fall; door panels and side panels blew off. Big panels fell on people's heads. It was like an implosion. Everything came down from the ceiling and the walls inward to us."
One word flashes through Christensen's mind: Lockerbie.
"I knew it was a terrorist bomb. I thought, `Oh, my God, how did they get us way out here in Hawaii?' I thought we were goners."
Christensen rises and moves forward. Instincts and training kick in as he starts removing large sections of ceiling and wall panels from on top of passengers.
He spots a dangling oxygen mask, grabs it and inhales a nauseating nicotine taste. He discards it, and finds he is able to breathe. The plane has apparently started descending to a lower altitude where the air is more breathable.
He notices a dim light, source unknown, then yelling and screaming that is barely audible above the deafening roar of the jet engines. It's like standing on the tarmac without earplugs as the engines spool up.
Christiansen makes his way to midcabin, then to business class. A horrified man yells and points to 14 G and H, the last row in the business- class section. He yells over and over, "My wife! Go look for my wife!"
Elliott Maylor and Kevin and Susan Campbell live a world apart. Prior to Flight 811, neither Maylor nor the Campbells seemed likely candidates to tilt lances at the all-powerful closed fraternity of industry executives and government regulators that is the U.S. aviation-safety system.
Yet as the NTSB's investigation into Flight 811 unfolded, Kevin and Susan Campbell and Maylor, an aeromechanical engineer from North Seattle about to retire from The Boeing Co., began to pierce the veil of secrecy traditionally draped around airline accidents.
From opposite sides of the globe, the Campbells and Maylor launched exhaustive, quite unofficial inquiries of their own: the Campbells, initially to work through the grief of losing their beloved 24-year-old son, Lee, and Maylor because he had time on his hands and was curious.
On several trips to the U.S., the Campbells poked through the damaged aircraft, attended hearings, tracked down and interviewed survivors, amassed reams of documents and generally hounded officials from United, Boeing, the NTSB and the Federal Aviation Administration, which had certified the door as safe in the original design. A retired auto-dealership owner and an expert car mechanic, Campbell even fabricated key door parts to demonstrate his theories.
Meanwhile, Maylor, a 747 pressurization specialist who retired from Boeing in May 1989 after a long career, sat at his kitchen table in Seattle poring over press clippings and 747 documents.
A meticulous sort given to exploring the most obscure aspects of whatever subject happens to intrigue him, Maylor fastidiously mapped out various trees of logic, systematically trimming weak branches. "My interest was as a casual observer," he says.
Eventually, both self-made sleuths arrived at independent conclusions that, while differing on a few key points, were startling similar at the core. Campbell and Maylor deduced that ramp workers very likely told the truth in testifying that the doors were closed, latched and locked properly on Pan Am 125 and United 811, and that a stray or inadvertent electrical signal subsequently unlatched each door.
Lythgoe finds himself prone and bug-eyed and drenched in hot coffee. He hangs on to the stairwell with Umehira and Brentlinger. After donning a life vest he makes his way forward. Waving a safety placard, he signals first-class passengers to don their life vests. All seems to be moving in slow motion. Supervisor Brentlinger rouses a dazed and bloodied Benoit from beneath rubble, helps her to a seat, then straps herself into jump seat 1-left.
Lythgoe returns for instructions. The din is deafening. Brentlinger signals and mouths "sit down." Lythgoe crosses to the right side, then straps in 1-right, facing aft, staring out the hole. A moonlit wing is to his left. The devastated remains of business class is to his right.
In the wing, tattered wires spark like firecrackers near severed fuel lines. Terrified passengers lean and strain away from the hole. Lythgoe watches transfixed as the No. 4 outboard engine roars ablaze, flashing a long trail of flames. The No. 3 inboard engine coughs up sparks.
At Boeing, redundancy is king. Backups are beautiful. If one bolt is needed, a bolt within a bolt is used. Look anywhere on any Boeing plane and you will see examples like this.
When Maylor and the Campbells began examining the elaborate electro-mechanical setup of a 747 cargo door, they found it brimming with redundancy in many areas - but vulnerable to failure in a couple of key ways.
Something called the S2 switch, in particular, is a key safety device that also could be the Achilles' heel of the door, Maylor and Campbell contend.
S2 is the sensor/switch that reacts to the lock handle being depressed and the last lock swinging into place. When this happens, S2 cuts the 28-volt power from the open/close toggle. In doing so, it eliminates all power from the web of relays that must trip in precise sequence to start, run and stop the actuators.
Conversely, if S2 is not working, the toggle could remain live after the locks are in place, with no one realizing it. Flick it up and the latches would attempt to push past the locks. If the locks are weak or out of adjustment, it could take as little as 1.5 seconds for the latches to fully open, triggering the hook actuator. Hold the toggle up for another 1.5 seconds and hooks would push the door open; another 3 seconds and the door would start to lift out and up.
Maylor and Campbell agree that Brian Kitaoka almost certainly lowered, closed, latched and locked the door routinely and properly.
Maylor thinks the S2 switch was bad. He envisions Kitaoka standing on the cargo loading ramp, right hand on the toggle, left hand on the lock handle, hustling to dispatch the plane on schedule.
"He's standing on the ladder. He's held the toggle until the door is shut. He tells himself, `All right, it's shut.' He flips the lock handle. His other hand is still on the toggle. It's dark, it's late. He's tired. He's done this a thousand times before. He assumes the toggle is dead once he flips the lock handle. He inadvertently bumps the toggle up for 1.4 or less seconds, opening the latches just enough so that they hang on until 22,000 feet."
Thus, according to Maylor, what should have been a harmless, inadvertent action may have been a tragic error set into motion by a malfunctioning S2.
Christensen nears Row 15. He is alongside the forward service center, looking forward.
This is as close as he dares get to the edge of a black expanse. He sees a weird, orange glow where the fuselage should be. The starboard engines are roasting. Unseen, just a few feed ahead, is Sapolo, prone, clinging to a seat mount.
On the horizon, he sees Lythgoe in jump seat 1-right. Another shocking image: "Across the expanse I saw my fellow flight attendant sitting in his seat, on the edge of the hole, with the wind blowing, and the fire from the engines illuminating his face.
"Between Ed and me there was darkness. The whole right side of the airplane was missing. There was a dark hole where there used to be seats and people."
Backing away from the void, Christensen retreats to the nearest jump seat, 3-right, alongside the mid-cabin lavs.
A pregnant woman, assisted by her husband, is donning a life preserver. Out the windows, a horrifying sight: sparks and flames from both starboard engines trailing back as far as line of vision permits.
Thinking of the warm Pacific Ocean - and the sharks known to cruise the waters off the reef runway - Christensen reaches under the jump seat for a life vest and puts it on.
Maylor is not the first person to worry about S2. After the Pan Am incident, Boeing asked airlines to flick the toggle up after depressing the lock handle "to confirm the door is electrically inactive."
"The only possible reason to do something like that is to make sure S2 is working," Maylor says. "What that test tells you is there's a hidden weakness in the design. S2 could fail and you would never know it."
A few weeks after suggesting that test, Boeing asked airlines to cease the procedure because reports had come back that locks were being damaged. The implication: Bad S2 switches, indeed, were turning up and the latches were pushing weak locks out of the way and rotating open.
About this same time, as Boeing was building its case to blame ramp workers in the Pan Am case, a separate Boeing lab test revealed that a "spurious electrical signal" from a short circuit could cause the latch actuators to backwind the latches past weak locks.
Today, Boeing won't respond to questions about weaknesses in the design of the S2 switch because of "pending litigation," said company spokesman Chris Villiers.
After Flight 811, Boeing devised a new warning system that adds three new safety sensors to the door, including a green warning light installed near the toggle that illuminates when the latches rotate fully closed, then extinguishes when S2 cuts power. If the green light near the toggle does not go out as soon as a ramp worker starts to depress the lock handle, the worker is supposed to recognize the significance - that S2 has failed and the door is still live, Villiers said.
Kevin Campbell maintains that a stray spurt of electricity started up and continued the entire door-opening sequence about the time Flight 811 passed 22,000 feet.
He believes the 1.8-second delay between the "thump" and explosion represent the time it took the pull-in hooks to release, once the latches had rotated fully open, tripping the hook actuator.
Though there are multiple safety features designed to cut both 28-volt and 115-volt power to the door as soon the engines start up, Campbell maintains that there are numerous "hot" wires feeding other airplane systems routed near the wires leading to the door, which must have failed in just the right fluky way to start up and run the entire door-opening sequence.
One thing Campbell, Maylor and the NTSB agree on: Evidence on the door should confirm whose theory is most accurate - or whether they are all off base.
From somewhere forward comes the woman in white, bleeding and screaming deliriously. She scrambles over seats and debris. She lunges for door 3-right as if she knows precisely how to open it.
The man who yelled for Christensen to find his wife appears. A violent struggle follows. The man and Christensen subdue the woman in white and strap her into a seat.
Christensen returns to jump seat 3-right and straps in. The hysterical woman in white, now quiet, seems to trigger a silence of hopelessness throughout the cabin. The roaring starboard engines shut down.
Christensen sits numb, confronting death. Lythgoe visualizes ocean water gushing in the hole. He goes through the mental exercise of opening door 1-right, only to visualize a wall of sea water pouring in.
Then, above the din, a chorus of voices yells: "City lights! City lights!"
Sure enough, off the starboard side, Honolulu never twinkled more brilliantly.
Training kicks back in. For the first time, Christensen realizes the pilots still have control of the plane. He advises two male passengers, seated nearby, how to help him assist people down the evacuation slide and how to operate the evacuation gear on their own if he's incapacitated.
He locates a flashlight, turns it on and grips it tightly. With the light on, he'll be able to find it after the landing, should he lose his grasp on it. He knows he'll need it to direct the evacuation.
With the most conclusive evidence - the door itself - lying on the ocean floor, the NTSB on April 10, 1990, issued a report acknowledging that either a stray electrical signal or sloppy operation of the door caused the accident.
NTSB investigator Ron Schleede, in a remarkable acknowledgement of the Campbells' effort, carefully constructs two logic trees - only to chop the Campbells' theory down. Calling the stray-signal scenario "highly improbable," Schleede, relying on Boeing technical analysis, concludes the accident was caused by "the sudden opening of the improperly latched" door.
Schleede makes the crucial assumption that Flight 811's locks were "severely damaged," presumably by manual backwinding, in 18 separate instances in December 1988 in which, according to United maintenance logs, the door was operated manually.
Significantly, the door was not operated manually the morning of the accident, nor anytime in the previous several weeks. Kitaoka's 110-page deposition asserts that the door was operated electrically and that the closing sequence was entirely routine. His account is corroborated by both the ground and flight crews.
Schleede does not dispute Kitaoka's testimony, but suggests that the latch motor somehow shut down before finishing the latching sequence, leaving Kitaoka with the wrong impression that the latches were fully closed. Then, because the weak aluminum locks must have been severely bent or broken from past misuse, Schleede theorizes that Kitaoka was able to depress the lock handle and smoothly swing them into place over the open latches.
This is perhaps the weakest branch in Schleede's logic. Boeing designed the locks so they are virtually impossible to set unless the latches are fully closed.
Scrutinizing the exhibits accompanying Schleede's report, Elliott Maylor later discovers that a key illustration is drawn radically out of proportion, permitting the mislatch theory to work on paper.
And so, Schleede concludes that Flight 811 took off with the door flush, but with the grip of its eight little claws relaxed, waiting for the herd of elephants.
Flight 811, flying on its two port engines, makes a wide circle approaching the runway. Capt. Cronin, co-pilot Al Slater and second officer Thomas know they have one chance, and only one chance. They must bring the aircraft in at a higher-than-normal speed to keep the landing gear from buckling under the weight of the fuel tanks, still heavy despite dumping fuel all the way back. The rate of descent must be precise.
Twenty minutes after the explosion, they execute a picture-perfect touchdown at the Honolulu airport, rolling to a stop directly in front of the main terminal.
The greeting emblazoned in neon on the main tower was never more appropriate: Aloha.
Twenty-two months after Flight 811, Boeing and United decided not to contest liability and to jointly share payment of damages in any suits arising from the accident. Since both are represented by the same insurer, United States Aviation Insurance Group, joint responsibility made sense. But why plead no contest?
Lawyers representing victims have a theory: A no-contest plea shifts the focus away from questions of bad design and/or operation of the door and places it on the psychological profiles of the plaintiffs.
San Francisco plaintiff lawyer Jerry Sterns said Boeing and United knew it stood to get off relatively cheaply because only nine people died and most of the suits involve emotional-distress claims by passengers and crew members who survived. Extent of injury is difficult to prove in such cases, which typically result in relatively low settlements, Sterns noted.
Boeing could then make optimum use of Keith Gerrard's skills. Gerrard is a high-powered partner at Seattle's giant Perkins Coie law firm, who leads Boeing's defense in product-liability cases, and who is renowned for his ability to dissect plaintiffs' claims.
"They dug up personal details about you, anything they could think of that the jury might consider unsavory," said Christensen, who won a $200,000 award from Boeing after a grueling jury trial. "They made it sound as if we lived a spoiled, glamorous lifestyle and that all our problems were from pre-existing personality disorders, not Flight 811."
Gerrard said he was "not at liberty" to discuss legal strategies. He said to "make it clear" that a no-contest plea means "there was no admission of any wrongdoing."
Sept. 27, 1990
100 miles south of Honolulu
After several dives to 16,000 feet, the Navy deep-submergence vehicle Sea Cliff plucks the lower two-thirds of Flight 811's cargo door from the ocean floor.
The lock handle and all eight locks are found "deformed" in the locked position, with all eight latches "nearly open," according to the NTSB. Campbell later learns from sources that the locks are in relatively good shape, not nearly damaged enough to support the NTSB's official explanation, which assumes severely battered locks.
The latch actuator is in place, and so is the S2 switch. Analysis of those key electrical devices should help make - or disprove - the case for a stray or inadvertent signal opening the door.
A few days later, Sea Cliff retrieves the upper half. Both parts are shipped to a Boeing laboratory in Seattle where, for the next several weeks, the smoking gun is examined and tested by its creator.
"When you start dealing with electricity and corralling little electrons that bounce around and can decide by themselves to do different things, you're moving into an area that is beyond what humans can predict," says pilot Hal Sprogis as he packed his bags recently on his way to pilot a 747 to London.
Despite his skepticism, Sprogis, like the rest of us, faces a limited choice: He can accept the latest official rationale that the doors are safe, or, as Boeing executives are fond of saying, he can take a Greyhound bus.
Boeing declined to permit a cargo-door expert to be interviewed by The Times. Likewise, Leroy Keith, a top FAA safety official, whose Renton office certified the door, has ordered his cargo-door experts not to give interviews.
Boeing public-relations officer Villiers said extensive tests conducted since Flight 811 show that even four steel-reinforced locks are plenty strong enough to keep all latches in place during flight, under virtually all circumstances.
The new steel locks (braces on old planes, solid steel on ones delivered since the accident), combined with the new door-warning systems, make the door "completely safe," Villiers said.
June 21, 1991
John F. Kennedy Airport
A 4-year-old United 747-200 is being prepared for a flight to Tokyo when a circuit breaker for the aft cargo "pops," cutting off power. A mechanic resets the breaker, but it pops again, suggesting a short circuit somewhere in the door.
Mechanics operate the door manually, reset the circuit breaker, and then open and close it electrically a couple of times. The door now appears to be working properly.
Then, with the door closed and latched, but not yet locked - and no one touching the toggle - the latch actuator suddenly comes to life, rotating the latches open. The door hooks push the door open, and the lift actuator raises it fully open.
The powerful lift motor continues to run, trying to raise the door even higher, until a mechanic pops the circuit breaker.
Twenty-eight months after Flight 811, the first undisputed case of stray electricity opening a 747 cargo door has just occurred.
With the specter of Flight 811 still vivid, United officials took the unusual step of asking the NTSB to investigate the JFK door-opening incident.
The NTSB obliged and found that a cracked wire-bundle conduit, located near the door hinges, was exposed to wear and tear each time the door was opened or closed. Boeing began using the conduit in the early '80s to protect the wire bundle; instead, cracking led to several wires inside the conduit burning and fraying.
In late August the NTSB recommended that the FAA order airlines to inspect the conduit, which was installed on the aft cargo doors of 360 late-model jumbo jets delivered since 1981.
Campbell believes the NTSB recommendation was too narrow. He wants a review of cargo-door wires on some 500 older jumbo jets as well, if only because common sense suggests that opportunity for wear and tear increases with use.
Many of the 830 jumbo jets flying are 15 to 25 years old. To Campbell, it makes sense that with predictable regularity there could be stray signals from frayed wires trying to open locked cargo doors. For now, the steel locks apparently are keeping the doors secure, Campbell concedes.
But he is convinced that one day a stray signal will come along when the steel locks are misaligned.
For some reason Boeing's Villiers could not explain, Boeing designed the C-shaped latches with a tapered circumference, with the locks designed to ride on the "high shoulder" of the latches.
Campbell believes there will come a time when the steel locks will be misaligned on the low shoulder and a stray signal will start up the latch motor. Given the pairing of those two malfunctions, and depending on the pressurization forces involved, the latches could wedge the steel locks aside and move to the open position, Campbell theorizes.
Villiers refused to respond to questions about Campbell's theory. But he pointed out that in a battery of tests, Boeing engineers could not move the steel locks out of alignment.
Are the Campbells and Maylor misguided amateurs, as Boeing implies?
Maybe. However, the general claim that 747 doors remain dangerous was quietly but unequivocally legitimized by United Airlines last fall. In September, the carrier took the extraordinary step of disconnecting the cargo-door circuit breakers before each flight of a jumbo jet.
Just before each United 747 pushes back from the gate, a mechanic climbs into a small hatch behind the front wheel and opens a pair of circuit breakers, which removes all potential sources of power to the cargo doors, above and beyond the other power-cutting safety features already in place.
United spokeswoman Sara Dornaker said this is being done to "maximize the safety of the operation until a permanent fix can be applied."
"The fact that United is pulling the circuit breakers indicates to me that there really is a problem," said safety advocate Richard Livingston, president of the Airline Passengers Association of North America.
And yet the FAA failed to read any urgency into the matter, or to suggest that other 747 operators follow United's simple precaution. Instead, the FAA took 70 days to answer the NTSB's recommendation for a fleetwide conduit inspection, saying only that it may submit the inspection idea to the "notice of proposed rulemaking" process, which means Boeing and the airlines will have up to 60 days to show the FAA why a fleetwide inspection isn't needed.
The NTSB has been slow-footed as well. Boeing's analysis of the door was completed nearly a year ago, and yet both that analysis and investigator Schleede's interpretation have been kept off the public record to give officials from Boeing, United and the FAA time to review them.
This latest critique-behind-closed-doors will culminate in a formal ruling by the NTSB, expected by February, about evidence found on the door.
"It really is the idea of the goats in charge of the cabbage patch," said Livingston, himself a former FAA official. "What you have is the unhappy scenario of government and industry singing from the same song sheets."
Forty years ago, a symbiotic relationship between airplane makers, the airlines and federal authorities was crucial to the maturation of what was then a fledgling enterprise. Congress even mandated that the FAA both monitor and promote the industry, making the agency both frontline watchdog and chief cheerleader.
And yet while commercial aviation has long since metamorphosed into a hard-boiled, multibillion-dollar endeavor, the system of checks and balances has failed to evolve along with it.
For Susan Campbell, this perpetuates a cycle of fear and frustration: "All the facts leading to the tragedy on Flight 811 were there, they just were not put together by somebody who could say, `This is urgent, let's do something about it.' I don't know if it was breakdown in communication or complacency or what. And now all the facts are there, once again, that there is a continuing danger, and the same thing is happening."
Byron Acohido is The Seattle Times' aerospace reporter. Rob Kemp is a Times news artist. --------------------------------------------------------------- Electrical operation of a 747 cargo door
To make full use of a vast cargo hold, Boeing devised an outward-opening cargo door that operates by manipulating a toggle switch, which sets into motion a series of 28 volt relays, sensors and switches. This, in turn, activates three powerful 115 volt motors in a precise sequence.
Door closing sequence 1. Lowering. Depressing the toggle activates the first motor, which lowers the 800 lb. door in 10-15 seconds.
2. Shutting. As the door reaches the fuselage, pull-in hooks engage pins on each side of the doorway; a second motor wraps the hooks around the pins, pulling the door snugly shut in 1.5 seconds.
3. Latching. As the hook motor shuts down, eight c-shaped latches spaced evenly along the bottom edge of the door engage eight pins on the door sill. A third motor then rotates the latches around the pins, securing the door in 1.5 seconds.
4. Locking. The final step is manual: The worker depresses a handle in the middle of the door. This swings eight j-shaped locks into place over the latches, sealing the door.
S2, the Achilles heel. As the last lock swings into place, the S2 switch cuts 28 volt power from the toggle. If S2 is defective, the toggle remains live and susceptible to inadvertent or stray electrical signal starting the door opening sequence.
Reported by Byron Acohido, Times aerospace reporter.
Copyright (c) 1992 Seattle Times Company, All Rights Reserved.