United Kingdom
|
| Aircraft Type and Registration: | Lockheed L188C, G-LOFA |
| No & Type of Engines: | 4 Allison 501-D13 turboprop engines |
| Year of Manufacture: | 1959 |
| Date & Time (UTC): | 30 July 1996 at 1941 hrs |
| Location: | Near Berlin Schonefeld Airport, Germany |
| Type of Flight: | Cargo |
| Persons on Board: | Crew - 5 - Passengers - None |
| Injuries: | Crew - None - Passengers - N/A |
| Nature of Damage: | Localised tearing of structure and failure of rivets in region of freight-door aperture, distortion of crown skin, failure of door operating mechanism and damage to door securing shoot bolts. Flattening of forward end of dorsal fin |
| Commander's Licence: | Airline Transport Pilot's Licence |
| Commander's Age: | 36 years |
| Commander's Flying Experience: | 5,880 hours (of which 850 hours were on type) |
| Last 90 days - 145 hours | |
| Last 28 days - 6 hours | |
| Information Source: | AAIB Field Investigation |
Investigation
authority
The accident notification and initial investigation was carried out by the German authorities. However, as the aircraft and crew were based in the United Kingdom and the aircraft was due to be returning to its home base at Coventry Airport after temporary repair, the AAIB offered to complete the investigation. Subsequently, in accordance with Chapter 5.1 of Annex 13 to The Convention on International Civil Aviation, the German authorities delegated the investigation to the United Kingdom.
History of
the flight
The crew arrived
at the aircraft at 1850 hrs for a planned flight to Cologne-Bonn;
they had operated the aircraft on the previous flight from Cologne-Bonn
and had spent the day resting in an hotel. In addition to the normal
complement of commander, first officer, flight engineer and ground
engineer, there was a trainee flight engineer with the crew. When
they arrived at G-LOFA, the ground staff were around the aircraft,
the doors were shut, external power was connected and steps were
adjacent to the crew door.
While the flight
crew went to the cockpit to complete their normal pre-flight duties,
the ground engineer carried out a daily maintenance check and signed
for this in the aircraft Technical Log. The flight engineer and
his trainee also went to the cockpit where the flight engineer demonstrated
his duties to the trainee. Once the company handling agent had been
to the cockpit to inform the commander that loading was complete
and had left with his copies of the Technical Log entry and Load
Sheet, the commander initiated the pre-start checks. As he did so,
the ground engineer entered the aircraft and closed the crew door;
he had confirmed that the other external doors were shut by ensuring
that they were flush with the fuselage and confirmed that the appropriate
door open indicating lights were not illuminated on the instrument
panel.
For the subsequent
engine start and flight, the flight crew occupied their normal
seats while the trainee flight engineer was in the cockpit 'jump
seat' and the ground engineer was in the courier seat (located between
the flight-deck bulkhead and the 9G cargo bulkhead). The cockpit
door was open in accordance with normal company regulations with
the courier seat occupied. Engine start was normal and no abnormal
indications were noted then, or during the subsequent taxiing to
Runway 25. Pre take-off checks were completed and the commander,
as handling pilot, carried out the take-off and established the
aircraft in the climb. The after take-off checks were completed
and during these, the flight engineer confirmed that pressurisation
was satisfactory; the aircraft was pressurising in accordance with
his selection. As these checks were being actioned, the ground engineer
went back to the cargo compartment.
As the aircraft
climbed through Flight Level (FL) 60, the ground engineer came back
to the cockpit and informed the commander that there appeared to
be 'smoke' in the cargo compartment. The crew checked the appropriate
systems, but detected no warnings. On this aircraft, the 'cargo
smoke' warning light was immediately adjacent to the 'cargo door
open' warning light located in front of the first officer. Shortly
afterwards, as the aircraft was passing FL 115, with the ground
engineer in the cockpit and the cockpit door shut, there was an
explosive decompression. The cockpit door detached from its hinges
and the cockpit filled with fine debris. The aircraft rolled right,
pitched down and the crew were immediately conscious of significant
airframe vibration. With the aircraft in cloud, the commander regained
level flight using minimum and gentle control inputs. As he did
so, the other crew members were making a thorough check of the aircraft
systems. The flight engineer prepared to activate the crew oxygen
but, with the aircraft descending below FL 100, decided that it
was not required. The only apparent problem was the loss of aircraft
pressurisation, but the commander was concerned about structural
integrity. He therefore instructed the first officer to ask for
radar vectors and a priority return to Schonefeld, and then commenced
a shallow turn back towards the airfield.
As the flight
crew were carrying out these actions, the ground engineer went back
to the cargo compartment to ascertain what damage had occurred.
There was cargo positioned close to the cargo door but the engineer
was able to see daylight where the door should have been. As he
got closer, he could see the door jacks still connected between
the frame and the door, and estimated that the door was then open
by approximately one foot. However, after moving closer to the open
door, he became aware that the door jacks and door were no longer
visible. From his position, he could partly see the left stabiliser
and observed no obvious signs of damage. He then returned to the
cockpit and reported to the commander that the cargo door was open.
By this time,
the commander had established on track to Schonefeld at 180 kt.
The vibration, although still significant, had reduced slightly.
ATC offered the crew radar vectors for an approach to Runway 25
but taking into account the light surface wind the crew requested,
and were granted, the more expeditious approach to Runway 07. For
the recovery, the normal checks were completed apart from the decision
to use less than full flap. This was selected gradually and at 78%
flap, speed was reduced to 150 kt and the landing gear was lowered.
With no control problems evident in this configuration, the commander
decided to use 78% flap for landing and the appropriate threshold
speeds were calculated. The subsequent landing on Runway 07 was
uneventful and the cargo door swung back into view as the speed
reduced on the runway. After parking the aircraft on stand and securing
the engines, the crew noted that the 'cargo door unlocked' light
was still not 'on' and that the main annunciator door warning light
only illuminated when the crew door was opened.
The commander
then disembarked from the aircraft and went to the open cargo door.
He noted that the external door warning light located beside the
cargo door was illuminated. On returning to the cockpit, he noted
that the 'cargo door unlocked' warning light still appeared to be
unlit but, as he touched it, he became aware that it was illuminated
but that its brilliance could be varied from 'full off' (where it
had been set) to 'full bright'.
Subsequent enquiries revealed that the cargo door was closed by a member of the airport ground staff. He was certain that the door had been correctly closed and that the adjacent external 'door unlocked' warning light had gone out.
Door design
The freight
door on the aircraft was one of a variety of designs on Lockheed
L188 aircraft on the British register, being a Supplementary Type
Certificate (STC) modification of the original passenger-carrying
L188, under STC number ST 852SO . It is understood to be the largest
of the door designs available and is both actuated and latched by
an electro-hydraulic system controlled normally from a switch under
a hinged panel on the outside of the fuselage, near the door.
The door is
hinged at the top and is secured in the closed position by a system
of seven horizontal 'shoot-bolts' mounted at the junction of the
fuselage side and the cabin floor. These are hydraulically driven
and pass through a system of lugs attached to the door sill. When
the door is fully closed, the shoot-bolts engage in a set of corresponding
lugs attached to the lower ends of seven frame members within the
door structure. Thus the hoop loads due to cabin pressurisation
are carried across the door aperture when the aircraft is in flight.
Two lights should be located under the hinged panel beside the external door operating switch, one of which should illuminate whilst the hydraulic door operating motor is running, the other illuminating whilst any of the door latching shoot-bolts are not fully engaged.
Aircraft
examination
Examination of the aircraft showed that the door had not been fully latched at the time of departure, ie the seven tapered shoot-bolts were only partly engaged. The hoop loading due to pressurisation had become sufficient, as the aircraft climbed, to effectively 'guillotine-off' the small diameter ends of the bolts and thus release the door. Extensive damage to the fuselage structure in the area of the door aperture had occurred, and failure of the door operating mechanism had allowed the door to overtravel open to such an extent that the foremost section of the dorsal fin had been 'flattened' by door contact and numerous rivets had failed in the fuselage structure. Local tearing of structural members had also occurred.
Door mechanism
and warning system
A detailed study
of the door showed that it was of a design which could not be reliably
checked for correct security from outside. Opening, followed by
re-closing and latching of the door illuminates and then extinguishes
the door-latched light beside the operating switch to indicate that
the door has correctly sequenced to the latched condition, with
all seven bolts fully engaged. Once the door is closed, however,
the shoot-bolts cannot be viewed from outside the aircraft and the
relevant area inside the fuselage cannot be accessed if the rear
of the hold is occupied by freight containers.
The associated
cockpit warning in the STC modification consisted of the routing
of the 'freight door unsafe' warning signal through the 'cabin doors
unsafe' annunciator light.
The arrangement
of the system on G-LOFA contained a number of modifications relative
to the STC design standard and also contained some wiring changes
which had either been made after the STC modification was complete,
or were the result of failure to fully incorporate the STC features.
In particular,
the wiring of the 'freight door unsafe' signal to the 'cabin doors
unsafe' annunciator was completely absent, although a dedicated
'freight door unsafe' warning light, originally positioned beside
the crew entry door (along with an alternative operating switch,
which had been deleted at some time prior to this accident) had
been re-positioned on the co-pilot's panel. This light had a dimming
facility which had the ability to dim to such an extent that the
light filament could become completely obscured. The light could
thus be 'ON', yet not visible to the crew. Its 'press to test' facility,
a feature of the STC modification, was also totally absent from
this aircraft and there was thus no ready means of realising that
the light was set to the 'bulb fully obscured' position.
Under all normal
sequences of aircraft operation, the forward crew entry door would
have been closed last, and so there were normally no circumstances
when the crew would have been in the cockpit with the freight door
open and all other doors closed. The absence of any warning on the
'freight door unsafe' annunciator, when the freight door was open
or not correctly latched, would therefore never have been evident
to any crew members.
The second of the two lights beneath the external hinged panel, intended to illuminate when the hydraulic motor was running, was absent from the aircraft.
Documentation
The Electra
188 C Operating Manual, a copy of which was held in the aircraft,
incorrectly stated that the 'doors unsafe' annunciator would illuminate
if any cabin door was not closed and latched. This statement not
only failed to draw attention to the fact that the freight door
warning was not connected to the annunciator on G-LOFA, but was
ambiguous in failing to mention that the rear emergency door (on
the right side) was also not monitored by the annunciator system.
This last discrepancy appears to have existed in the Operating Manual
since it was written for the original passenger aircraft in 1959.
A Flight Manual Supplement covering the freight door modification included a wiring schematic diagram which showed the 'freight door unsafe' signal as passing through the 'cabin doors unsafe' annunciator. In this respect it agreed with the STC design standard but did not reflect the modification standard of G-LOFA.
Modification
status
The STC modification
incorporating the freight door on G-LOFA was designed by Aeronautical
Engineers Inc (AEI) of the USA. At some later date it appears to
have been modified in accordance with hydraulic and electrical system
drawings produced by General Air Services Inc, also of the USA,
to change from a system using a micro-switch operated sequence valve
to one of a hydraulic pressure operated priority valve to control
the sequence of door closing motion and shoot-bolt engagement. It
is not known when the changes to the wiring of the warning system
were made from the AEI standard or to what extent, if any, the AEI
design was not fully implemented at the time the original freight
door modification was incorporated.
In summary,
the study of the STC and details of its implementation on G-LOFA
showed that:
1 The STC door
design presents considerable difficulties in establishing reliably
the state of door security after closure.
2 The wiring
of the door warning system differed from that in the STC and from
the schematic in the Flight Manual Supplement for the freight door.
Some of these wiring differences undermined the logic of the warning
arrangements.
3 The dedicated
warning light on the co-pilot's panel was designed so that its 'dimming'
function could be adjusted such that it completely obscured the
warning, yet had no placard warning to that effect.
4 Important safety related information in the Electra 188 C Operating Manual on board the aircraft was incorrect.
Safety Recommendations
In view of the
potentially critical consequences that can arise from the in-flight
opening of aircraft doors, and since this event could have resulted
in a serious accident, the following Safety Recommendations have
been made to the CAA and FAA.
96-66: In
order to prevent the freight doors on Lockheed L188 Electra freighter
aircraft from opening in flight, as a result of failure to ensure
correct latching of such doors before flight, the CAA should require
that the following safety action is applied to all such aircraft
on the UK register, and the FAA should require the same safety action
for all other such aircraft worldwide:
1 An inspection
to confirm that the 'cabin-doors unsafe' annunciator illuminates
when the freight door is not in the closed and fully latched condition,
and when all other cabin doors are in a fully safe condition.
2 An examination
of any wiring diagrams or schematics of the door warning system
in L188 Flight Manual supplements and Maintenance Manuals to confirm
that they correctly represent the state of the wiring of the individual
aircraft to which they apply, are in accordance with an FAA approved
design and have been the subject of a design safety analysis.
3 The revision
of the Electra 188C Operating Manual to identify any door(s) which
are not monitored by the 'cabin-doors unsafe' annunciator once the
above actions have been carried out.
4 Consideration
be given to providing a clear physical warning, in addition to the
existing locks unsafe light, of the absence of correct lock engagement,
visible from outside of outward opening freight doors on L188 freighter
aircraft.