United Airlines Flight 811

Departure from Honolulu

United Airlines Flight 811 was a scheduled service from Los Angeles to Sydney, with stops at Honolulu and Auckland. On 24 February 1989, a new flight crew took over at Honolulu after a layover. The captain reviewed the flight plan, weather, notices and maintenance records before boarding. The earlier crew had reported no difficulty on the flight from Los Angeles. N4713U was a Boeing 747-122 powered by four Pratt & Whitney JT9D engines.

At Honolulu, ramp personnel opened and closed the forward cargo door electrically. They later said the door was flush with the fuselage, its master latch lock handle was stowed and its pressure relief doors were flush with the door skin. A dispatch mechanic also inspected those features during the departure check. The second officer tested the door warning lights and made an exterior inspection while cargo loading was underway. He reported that all cabin and cargo door warning lights were out before departure.

The aircraft left its gate at 01:33 with 337 passengers, 3 flight crew and 15 cabin crew. Takeoff clearance for runway 8R came at 01:52:49. The captain flew the aircraft. The auxiliary power unit remained in use for takeoff and was shut down shortly after the initial reduction to climb thrust. Thunderstorms were visible and appeared on the weather radar. The crew obtained clearance to deviate left of course, and the captain kept the seat belt sign on.

The door separates during climb

The climb initially appeared normal. Between 22,000 and 23,000 feet, at an indicated airspeed of 300 knots, the crew heard a thump followed by a much louder bang. The cockpit voice recorder timed the loud bang at 02:09:09.2. The forward lower cargo door had opened and separated. The resulting decompression tore away fuselage structure above the door and broke the adjacent cabin floor beams downward. Nine passengers were swept through the opening and lost at sea.

The damage extended through several systems. Debris struck the right wing, tail surfaces and both right engines. Oxygen supply lines below the damaged cabin floor broke, cutting the supply to the flight crew and passenger oxygen systems. The pilots put on their oxygen masks and found no oxygen available. The decompression briefly interrupted recorder data; when the flight data recorder resumed, the pitch and roll parameters were affected.

The captain immediately began an emergency descent, turning left toward Honolulu while avoiding a thunderstorm. Engine 3 showed heavy vibration and abnormal compressor, temperature and pressure indications, and the crew shut it down. The second officer left the cockpit to inspect the cabin and returned with news that a large part of the forward right fuselage was missing. Engine 4 subsequently showed high exhaust temperature, absent compressor indication and flashes of fire. The captain shut it down as well. Fuel dumping began during the descent to reduce landing weight.

Cabin preparations and a two-engine landing

Flight attendants attended to injured people and prepared the cabin for a possible ditching, then for evacuation on land. Portable oxygen bottles presented immediate difficulties because their masks were detached from the regulators. The aft purser went to the rear left flight attendant station seeking oxygen and found no bottle there. She returned to another station, where a colleague placed an oxygen mask on her face. Other attendants helped passengers fasten life preservers and prepare for the emergency.

Cabin noise made communication difficult. The public address system was operating, but its announcements were hard to hear. The two megaphones helped attendants near their storage positions communicate. Elsewhere, attendants shouted, used hand signals and held up safety cards and life preservers. Passengers in the front of the upper deck passed the instructions visually to people behind them. Open overhead storage-compartment doors and spilled contents obstructed exits, so the crew closed the compartments and cleared the debris.

The aircraft approached runway 8L with only engines 1 and 2 operating. Its final approach speed was 190 to 200 knots. The crew saw an asymmetric flap indication during extension and selected 10 degrees of inboard trailing edge flap. The outboard leading edge flaps on the right wing failed to extend. Investigators attributed that failure probably to damage to the pneumatic ducting from ejected debris.

Touchdown occurred approximately 1,000 feet beyond the approach end of the runway. The aircraft stopped about 7,000 feet later with idle reverse thrust and moderate to heavy braking. By 02:34, the crew had told the tower that the aircraft was stopped and evacuation had begun. Nine passengers had died, five people had serious injuries and 33 had minor injuries. Of the 355 people aboard, 346 survived. The subsequent air and sea search did not recover the missing passengers.

How the cargo door was secured

The Boeing 747 lower cargo doors opened outward and carried loads imposed by cabin pressurization. The forward door was hinged along its upper edge. Eight latch cams along its bottom rotated around pins fixed to the lower door sill. Midspan latches kept the sides aligned, while pull-in hooks drew the door into place during closure. Electric actuators moved the door, operated the hooks and rotated the latch cams in sequence.

Ground personnel completed the closing sequence by moving the external master latch lock handle. That action placed lock sectors across the open mouths of the lower latch cams. It also closed the small pressure relief doors, whose position gave an indirect visual indication of locking. The master latch lock switch was intended to remove control power when the handle was stowed. The original lock sectors could be deformed by the force of the latch actuator, allowing the cams to move toward open while the locking handle remained stowed.

The initial certification arrangement provided eight view ports through which ground personnel could check painted alignment marks on the latch cams against arrows on their supports. Boeing later sought approval for an alternative check using the pressure relief doors. The FAA approved that method, and operators were no longer required to inspect the latch alignment marks before dispatch. The NTSB found that the failure analysis supporting the alternative method depended on an invalid assumption about the effectiveness of the lock sectors.

Recovery changes the investigation

The NTSB first adopted a report in April 1990 while the cargo door remained on the ocean floor. The Navy used radar observations of falling debris and analysis of ocean currents to define a search area. A sonar search began in July 1990, followed by dives with the manned submersible Sea Cliff. The lower portion of the door was recovered on 26 September and its upper portion on 1 October, at a depth of 14,200 feet. Heavy seas prevented recovery of the fuselage structure above it.

Examination showed the latch cams near the unlatched position, with the lock sectors still in the locked position and jammed against the cams. Heat tinting and transferred metal on the latch pins located the cams during the high-load separation. Tests and the recovered mechanism led the NTSB to conclude that the door had initially been fully latched and locked. The cams had subsequently been driven toward open, deforming the sectors.

Structural examination found fresh overload breaks around the opening. Paint transferred onto the door matched the upper fuselage paint pattern, and damage to the hinge area, hooks and pins showed that the door had been intact when it flew open and struck the aircraft. The calculated pressure differential was about 6.5 psi, within the design limits for a properly secured door. The displaced latches reduced its ability to resist that pressure.

The actuator manual-drive seal had suffered impact and underwater damage. Its condition made manual operation after closure unlikely. The electrical system supplied door power from external power or the auxiliary power unit through the ground handling bus. Engine generators could not power that bus. Because the auxiliary power unit was shut down during climb, electrical actuation at the moment of separation was impossible. The NTSB considered the latch movement most likely to have occurred on the ground before engine start.

Final findings and safety action

The recovered switches had been damaged during immersion, and some wiring was missing. Investigators found insulation damage on recovered wires, but tests were inconclusive about whether a short circuit would necessarily leave detectable arcing. The NTSB could not determine the precise electrical fault. Its superseding final report, adopted on 18 March 1992, attributed the opening to a faulty switch or wiring that permitted latch actuation after initial door closure and before takeoff. Deficient lock-sector design and delayed corrective action by Boeing and the FAA contributed.

A cargo door opening on another Boeing 747 in 1987 had revealed the weakness of the original lock sectors. The FAA subsequently required strengthening, but the directive allowed 18 or 24 months for the terminating modification, depending on model. N4713U had yet to receive the strengthened sectors when Flight 811 departed. The NTSB found that the manufacturer and regulator had missed opportunities to revisit the design assumptions and require faster corrective action.

The recommendations addressed both prevention and survival. The NTSB called for independent positive indications of latch and lock positions and for removal of actuator power after cargo door closure, while retaining power needed for position indications. Cabin recommendations covered masks attached to portable oxygen regulators, accessible megaphones, safer overhead storage latches and easier life-preserver adjustment. The investigation also found that airport and military rescue vehicles could not communicate directly by radio during the response. It recommended a common communications arrangement and more visible markings for rescue vehicles.