Original NTSB AAR for UAL 811 with wrong probable cause and AAIB AAR for PA 103

NTSB AAR 90/01 UAL Flight 811

CONTENTS

EXECUTIVE SUMMARY v

1. FACTUAL INFORMATION

1.1 History of Flight 1

1.2 Injuries to Persons 3

1.3 Damage to Airplane 3

1.4 Other Damage 7

1.5 Personnel Information 7

1.6 Aircraft Information 9

1.6.1 General 9

1.6.2 Cargo Door Description and Operation 9

1.6.3 UAL B-747 Special Procedures--Doors 14

1.6.4 UAL Maintenance Program 15

1.6.5 Maintenance Records Review 16

1.6.6 Service Difficulty Report Information 18

1.6.7 Service Letters and Service Bulletins 19

1.6.8 Airworthiness Directives 19

1.7 Meteorological Information 20

1.8 Navigational Aids 20

1.9 Communication 21

1.10 Aerodrome Information 21

1.11 Flight Recorders 21

1.12 Wreckage and Impact Information 22

1.13 Medical and Pathological Information 22

1.14 Fire 22

1.15 Survival Aspects 22

1.16 Tests and Research 24

1.16.1 Forward Cargo Door Electrical Component Examinations 24

1.16.2 Pressurization System 25

1.16.3 Safety Board Materials Laboratory Examinations -- Cargo Door Hardware 25

1.16.4 General Inspection of Other UAL Airplanes 26

1.17 Additional Information 29

1.17.1 Previous Cargo Door Incident 29

1.17.2 FAA Surveillance of UAL Maintenance 30

1.17.3 Corrective Actions 32

1.17.4 Boeing 747 Cargo Door Certification 33

1.17.5 Advisory Circular AC 25.783-1 35

2. ANALYSIS

2.1 General 36

2.2 Loss of Cargo Door 37

2.3 Partially Closed Door 37

2.4 Electrical Opening of the Door on the Ground or in Flight 39

2.5 Incomplete Latching of the Door During Closure 41

2.6. Design, Certification, and Continuing Airworthiness 45

2.7 Survival Aspects 48 3. CONCLUSIONS

3.1 Findings 51

3.2 Probable Cause 52

4. RECOMMENDATIONS 53

5. APPENDIXES 57

Appendix A--Investigation and Public Hearing 57

Appendix B--Personnel Information 58

Appendix C--Airplane Information 62

Appendix D--Injury Information 63

Appendix E--Maintenance History of N4713U 66

 EXECUTIVE SUMMARY

On February 24, 1989, United Airlines (UAL), flight 811, a Boeing 747-122 (B-747), N4713U, was being operated as a regularly scheduled flight from Los Angeles, California (LAX) to Sydney, Australia (SYD) with intermediate stops in Honolulu, Hawaii (HNL) and Auckland, New Zealand (AKL). There were 3 flightcrew, 15 flight attendants, and 337 passengers aboard the airplane.

The flightcrew reported the airplane's operation to be normal during the takeoff from Honolulu, and during the initial and intermediate segments of the climb. The flightcrew observed en route thunderstorms both visually and on the airplane's weather radar, so they requested and received clearance for a deviation to the left of course from the HNL Combined Center Radar Approach Control (CERAP). The captain elected to leave the passenger seat belt sign "on."

The flightcrew stated that the first indication of a problem occurred while the airplane was climbing between 22,000 and 23,000 feet at an indicated airspeed (IAS) of 300 knots. They heard a sound, described as a "thump," which shook the airplane. They said that this sound was followed immediately by a "tremendous explosion." The airplane had experienced an explosive decompression. They said that they donned their respective oxygen masks but found no oxygen available. Engines No. 3 and 4 were shutdown because of damage from foreign object ingestion.

The airplane made a successful emergency landing at HNL and the occupants evacuated the airplane. Examination of the airplane revealed that the forward lower lobe cargo door had separated in flight and had caused extensive damage to the fuselage and cabin structure adjacent to the door. Nine of the passengers had been ejected from the airplane and lost at sea.

The issues in this investigation centered around the design and certification of the B-747 cargo doors, and the operation and maintenance to assure the continuing airworthiness of the doors.

The National Transportation Safety Board determines that the probable cause of this accident was the sudden opening of the improperly latched forward lower lobe cargo door in flight and the subsequent explosive decompression. Contributing to the cause of the accident was a deficiency in the design of the cargo door locking mechanisms, which made them susceptible to inservice damage, and which allowed the door to be unlatched, yet to show a properly latched and locked position. Also contributing to the accident was the lack of proper maintenance and inspection of the cargo door by United Airlines, and a lack of timely corrective actions by Boeing and the FAA following the 1987 cargo door opening incident on a Pan Am B-747.

The Safety Board issued three safety recommendations as a result of this investigation that addressed measures to improve the airworthiness of the B-747 cargo doors and other non-plug doors on pressurized transport category airplanes. It also issued recommendations affecting cabin safety.

 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594

AIRCRAFT ACCIDENT REPORT

UNITED AIRLINES, FLIGHT 811 BOEING 747-122, N4713U HONOLULU, HAWAII FEBRUARY 24, 1989

1. FACTUAL INFORMATION

1.1 History of Flight

On February 24, 1989, United Airlines (UAL), flight 811, a Boeing 747-122 (B-747), N4713U, was being operated as a regularly scheduled flight from Los Angeles, California (LAX) to Sydney, Australia (SYD) with intermediate stops in Honolulu, Hawaii (HNL) and Auckland, New Zealand (AKL).

The flightcrew assigned to the LAX/HNL route segment reported no difficulty during their flight.

A flightcrew change occurred when flight 811 arrived at HNL. The oncoming captain stated that he and his crew reported to UAL operations 1 hour and 15 minutes prior to the flight's scheduled departure time from HNL. The crew had completed a 34-hour layover (rest period) in HNL.

The captain reviewed the flight plan, the weather, pertinent NOTAMs, and maintenance records, and signed the Instrument Flight Rules (IFR) clearance before boarding the airplane.

Flight 811 departed HNL gate 10 at 0133 Honolulu Standard Time (HST), 3 minutes after the scheduled departure time, with 3 flight crewmembers, 15 cabin crewmembers, and 337 passengers. The flightcrew attributed the short delay to cabin crew problems with arming the 5L cabin door emergency exit slide and the normal securing of the 2L door after a somewhat extended passenger boarding process. The second officer stated that all cabin and cargo door warning lights were out prior to the airplane's departure from the gate. He said that he dimmed the annunciator panel lights at his station while the airplane was departing the gate area.

The captain was at the controls when the flight was cleared for takeoff on HNL runway 8R at 0152:49 HST. The auxiliary power unit (APU), which was used during the takeoff, was shutdown shortly after making the initial power reduction to climb thrust.

The flightcrew reported the airplane's operation to be normal during the takeoff and during the initial and intermediate segments of the climb. The flightcrew observed en route thunderstorms both visually and on the airplane's weather radar, so they requested and received

 clearance for a deviation to the left of course from the HNL Combined Center Radar Approach Control (CERAP). The captain elected to leave the passenger seat belt sign "on."

The flightcrew stated that the first indication of a problem occurred while the airplane was climbing between 22,000 and 23,000 feet at an indicated airspeed (IAS) of 300 knots. They heard a sound, described as a "thump," which shook the airplane. They said that this sound was followed immediately by a "tremendous explosion." The airplane had experienced an explosive decompression. They said that they donned their respective oxygen masks but found no oxygen available. The airplane cabin altitude horn sounded and the flightcrew believed the passenger oxygen masks had deployed automatically.

The captain immediately initiated an emergency descent, turned 180( to the left to avoid a thunderstorm, and proceeded toward HNL. The first officer informed CERAP that the airplane was in an emergency descent and appeared to have lost power in the No. 3 engine. The appropriate 7700 emergency code was placed in the airplane's radar beacon transponder and an emergency was declared with CERAP at approximately 0220 HST. The No. 3 engine was shut down shortly after commencing the descent because of heavy vibration, no N1 compressor indication, low exhaust gas temperature (EGT), and low engine pressure ratio (EPR).

The second officer then left the cockpit to inspect the cabin area and returned to inform the captain that a large portion of the forward right side of the cabin fuselage was missing. The captain subsequently shut down the No. 4 engine because of high EGT and no N1 compressor indication, accompanied by visible flashes of fire. The flightcrew initiated fuel dumping during the descent to reduce the airplane landing weight.

The airplane was cleared for an approach to HNL runway 8L. The final approach was flown at 190 to 200 knots with the No. 1 and No. 2 engines only. During flap extension, the flightcrew observed an indication of asymmetrical flaps as the flap position approached 5(. The flightcrew decided to extend inboard trailing edge flaps to 10( for the landing. The right outboard leading edge flaps1 did not extend during the flap lowering sequence. The airplane touched down on the runway, approximately 1,000 feet from the approach end, and came to a stop about 7,000 feet later. The captain applied idle reverse on the Nos. 1 and No. 2 engines and employed moderate to heavy braking to stop the airplane. AT 0234 (HST), HNL tower was notified by the flightcrew that the airplane was stopped and an emergency evacuation had commenced on the runway.

 After the accident, UAL ramp service personnel, who had been involved with the cargo loading and unloading of flight 811 before takeoff from HNL, stated that they had opened and closed the forward cargo door electrically. They said that they had observed no damage to the cargo door. The ramp service personnel said that they had verified that the forward cargo door was flush with the fuselage of the airplane, that the master door latch handle was stowed, and that the pressure relief doors were flush with the exterior skin of the cargo door.

The dispatch mechanic stated that, in accordance with UAL procedures, he had performed a "circle check" prior to the airplane's departure from the HNL gate. This check included verification that the cargo doors were flush with the fuselage of the airplane, that the master latch lock handles were stowed, and that the pressure relief doors were flush or within 1/2 inch of the cargo door's exterior skin. He said a flashlight was used during this inspection.

The second officer stated that, in accordance with UAL Standard Operating Procedures (SOP) he had performed an operational check of the door warning annunciator lights as part of his portion of the cockpit preparation. The second officer also stated that he used a flashlight while performing an exterior inspection, again in accordance with UAL procedures. The exterior inspection was conducted while ramp service personnel were performing cargo loading operations and the cargo doors were open. He stated that he had observed no abnormalities or damage.

1.2 Injuries to Persons

Injuries Flightcrew Cabincrew Passengers Others Serious * Lost in flight. An extensive air and sea search for the passengers was unsuccessful.

1.3 Damage to the Airplane

The primary damage to the airplane consisted of an approximate 10 by 15-foot hole on the right side in the area of the forward lower lobe cargo door. The cargo door fuselage cutout lower sill and side frames were intact but the door was missing (see figures 1 and 2). An area of fuselage skin measuring about 13 feet lengthwise by 15 feet vertically, and extending from the upper sill of the forward cargo door to the upper deck window belt, had separated from the airplane at a location above the cargo door extending to the upper deck windows. The floor beams adjacent to and inboard of the cargo door area had been fractured and buckled downward.

 Figure 1.--Overall view of forward cargo door area on the right side of the aircraft.

 Figure 2.--Close-up view of hole and surrounding structure damage.

 Examination of all structure around the area of primary damage disclosed no evidence of preexisting cracks or corrosion. All fractures were typical of fresh overstress breaks.

Debris had damaged portions of the right wing, the right horizontal stabilizer, the vertical stabilizer and engines Nos. 3 and 4. No damage was noted on the left side of the airplane, including engines Nos. 1 and 2.

The right wing had sustained impact damage along the leading edge between the No. 3 engine pylon and the No. 17 variable camber leading edge flap. Slight impact damage to the No. 18 leading edge flap was noted.

There was a break and scuff in the wing leading edge aft of engine No. 4 and a scuff in the wing leading edge outboard of engine No. 4. There was a large indentation (to a depth of nearly 8 inches) in the area just above the outboard landing light, and the landing light covers were broken. There was a small puncture in the upper surface of the No. 14 krueger flap and impact damage to the wing leading edge just aft of the No. 14 krueger flap. There was a gash on the upper wing surface aft of the No. 14 krueger flap and leading edge, as well as punctures to the wing leading edge aft of the number 16 krueger flap. The under wing surface aft of the krueger flaps also sustained impact damage.

The right wing also had sustained damage at the wing-to-body fairing and two flap track canoe fairings.2 Wing-to-body fairing damage was limited to surface scraping forward of and below the wing. The outboard surface of the No. 6 flap track canoe fairing revealed a slightly more significant gouge mark. The most severe damage was evident on the inboard surface of the No. 8 flap track canoe fairing, where three separate punctured areas were observed. The trailing edge flaps were not damaged.

The leading edge of the right horizontal stabilizer had several dents. The most severe dents, located 8 to 10 feet from the stabilizer root, were approximately 3 inches wide and 1 inch deep. No punctures were found. The vertical stabilizer had multiple small and elongated indentations with a maximum depth of 1/2 inch near the right base of the leading edge. A small gouge and two small scrapes were noted at midspan of the upper rudder.

A piece of cargo container was found lodged between the No. 3 engine pylon (inboard) and the wing underside. The piece of metal had severed the pneumatic duct for the leading edge flaps. Various nicks and punctures were evident on the inboard side of the No. 3 engine pylon. The No. 4 engine pylon had a small puncture near the leading edge of the wing.

The external surfaces of the No. 3 engine inlet cowl assembly exhibited foreign object damage including small tears, scuffs and a large outwardly directed hole. The entire circumference of all the acoustic (sound attenuator) panels installed on the inlet section of the cowl had been punctured, torn, or dented. None of the No. 3 engine cases were penetrated by objects, nor was there evidence of fire damage to any visible engine components and accessories. The leading edges of all fan blade airfoils on the No. 3 engine exhibited extensive foreign object damage.

External damage to the No. 4 engine inlet and core cowls was confined to the inboard side of the inlet cowl assembly. The damage consisted of one major scuff mark, four lesser scuff marks and one crescent-shaped cut. The sound attenuator panels that were installed in the inlet area of the inlet cowl assembly had not been penetrated. The No. 4 engine fan blade airfoils had sustained both soft and hard object damage from foreign objects.

The cargo door separation resulted in the loss of fuselage shell structure above the cargo door, along with main cabin floor structure below seats 8GH through 12GH (see figure 3). The missing floor area extended inboard from the interior of the right side fuselage wall to the inboard seat track of seats 8GH through 12GH.

The supply and fill lines from the flightcrew oxygen bottle, and the supply line for the passenger oxygen system had been broken below the cabin floor inboard of the missing cargo door.

The two cabin pressurization out-flow valves, located on the underside of the fuselage, aft of the rear cargo compartment, were found fully open. The two over-pressure relief valves located on the forward left side of the airplane were found in the normal closed position. These valves were removed and bench tested. (See section 1.16.2, Pressurization System.) The majority of the cabin floor-to-cargo compartment blowout panels were found activated. The blowout panels are designed to relieve excess pressure differential following an explosive decompression to prevent catastrophic damage to the cabin floor structures.

The estimated damage to the airplane was $14,000,000, based on UAL's costs to repair it.

1.4 Other Damage

No other property damage resulted from this accident.

1.5 Personnel Information

The crew consisted of 3 flight crewmembers (the captain, the first officer, and the second officer) and 15 cabin crewmembers. (See appendix B.)

 Figure 3.--Forward view of Cabin Zone B. Note missing seats 8GH thru 12GH.

 1.6 Aircraft Information

1.6.1 General

On February 24, 1989, the United Airlines B-747 fleet consisted of 31 airplanes, including: 2 B-747-222B, 11 B-747-SP, 5 B-747-123, and 13 B-747-122 series airplanes. N4713U was equipped with four Pratt & Whitney model JT9D engines.

The accident airplane, serial no. 19875, registered in the United States as N4713U, was manufactured as a Boeing 747-122 transport category airplane by the Boeing Commercial Airplane Company (Boeing), Seattle, Washington, a Division of the Boeing Company. N4713U, the 89th B-747 built by Boeing, was manufactured in accordance with Federal Aviation Administration (FAA) type certificate No. A20WE, as approved on December 30, 1969. The airplane was certificated in accordance with the provisions of 14 CFR Part 25, effective February 1, 1965.

The maximum calculated takeoff weight for flight 811 was 706,000 pounds. The flight plan data showed an actual takeoff weight of 697,900 pounds. The center of gravity (CG) for takeoff was computed at 20.4 percent mean aerodynamic chord (MAC). The forward and aft CG limits were 12 and 29.7 percent MAC, respectively.

At the time of the accident, N4713U had accumulated 58,815 total flight hours and 15,028 flight cycles. N4713U had not been involved in any previous accident. Records indicated that the airplane had been inspected and maintained in accordance with the General Maintenance Program as defined in UAL Operations Specifications and in accordance with the FAA approved Aircraft and Powerplants Reliability Program. The records indicated that all required inspection and maintenance actions had been completed within specified time limits and all applicable airworthiness directives (AD) had been accomplished or were in the process of being accomplished, with the exception of AD 88-12-04, which was applicable to the B-747 lower lobe cargo door, and which had only been complied with partially. (See section 1.6.8 for explanation).

1.6.2 Cargo Door Description and Operation

Both the forward and aft lower cargo doors are similar in appearance and operation. They are located on the lower right side of the fuselage and are outward-opening. The door opening is approximately 110 inches wide by 99 inches high, as measured along the fuselage.

Electrical power for operation of the cargo door switches and actuators is supplied from the ground handling bus, which is powered by either external power or the APU. The engine generators cannot provide power to the ground handling bus. APU generator electrical power to the ground handling bus is interrupted when an engine generator is brought on line after engine start. The APU generator "field" switch can be reengaged by the flightcrew, if necessary on the ground, to power the ground handling bus. The air/ground safety relay automatically disconnects the APU generator from the ground handling bus, if it is energized, when the airplane becomes airborne and the air/ground relay senses the airplane off the ground.

The cargo door and its associated hardware are designed to carry circumferential (hoop) loads arising from pressurization of the airplane. These loads are transmitted from the piano hinge at the top of the door, through the door itself, and into the eight latches located along the bottom of the door. The eight latches consist of eight latch pins attached to the lower door sill and eight latch cams attached to the bottom of the door. The cargo door also has two midspan latches located along the fore and aft sides of the door. These midspan latches primarily serve to keep the sides of the door aligned with the fuselage. There are also four door stops which limit inward movement of the door. There are two pull-in hooks located on the fore and aft lower portion of the door, with pull-in hook pins on the sides of the door frame. (See figure 4 for cargo door components.)

The cargo doors on the B-747 have a master latch lock handle installed on the exterior of the door. The handle is opened and closed manually. The master latch lock handle simultaneously controls the operation of the latch lock sectors, which act as locks for the latch cams, and the two pressure relief doors located on the door. Figure 5 depicts a latch pin and latch cam in an unlocked and locked condition.

The door has three electrical actuators for opening/closing and latching of the door. One actuator (main actuator) moves the door from the fully open position to the near closed position, and vice versa. A second actuator (pull-in hook actuator) moves the pull-in hooks closed or open, and the third actuator (latch actuator) rotates the latch cams from the unlatched position to the latched position, and vice versa. The latch actuator has an internal clutch, which slips to limit the torque output of the actuator.

Normally, the cargo doors are operated electrically by means of a switch located on the exterior of the fuselage, just forward of the door opening. The switch controls the opening and closing and the latching of the door. If at any time the switch is released, the switch will return to a neutral position, power is removed from all actuators, and movement of the actuators ceases.

In order to close the cargo door, the door switch is held to the "closed" position, energizing the closing actuator, and the door moves toward the closed position. After the door has reached the near closed position, the hook position switch transfers the electrical control power to the pull-in hook actuator, and the cargo door is brought to the closed position by the pull-in hooks. When the pull-in hooks reach their fully closed position, the hook-closed switch transfers electrical power to the latch actuator. The

 

latch actuator rotates the eight latch cams, mounted on the lower portion of the door, around the eight latch pins, attached to the lower door sill. At the same time, the two midspan latch cams, located on the sides of the door rotate around the two midspan latch pins located on the sides of the door frame. When the eight latch cams and the two mid-span cams reach their fully closed position, electrical power is removed from the latch actuator by the latch-closed switch. This completes the electrically powered portion of the door closing operation. The door can also be operated in the same manner electrically by a switch located inside the cargo compartment adjacent to the door.

The final securing operation is the movement of lock sectors across the latch cams. These are manually moved in place across the open mouth of each of the eight lower cams through mechanical linkages to the master latch lock handle. The position of the lock sectors is indicated indirectly by noting visually the closed position of the two pressure relief doors located on the upper section of each cargo door. The pressure relief doors are designed to relieve any residual pressure differential before the cargo doors are opened after landing, and to prevent pressurization of the airplane should the airplane depart with the cargo doors not properly secured. The pressure relief doors are mechanically linked to the movement of the lock sectors. This final procedure also actuates the master latch lock switch, removing electrical control power from the opening and closing control circuits, and also extinguishes the cockpit cargo door warning light through a switch located on one of the pressure relief doors. Opening the cargo door is accomplished by reversing the above procedure.

The B-747 cargo door has eight (8) view ports located beneath the latch cams for direct viewing of the position of the cams by means of alignment stripes. Procedures for using these view ports for verifying the position of the cams were not in place or required by UAL (see 1.17.5 for additional information).

Closing the door manually is accomplished through the same sequence of actions without electrical power. The door actuator mechanisms are manually driven to a closed and latched position by the use of a one-half inch socket driver. The door can also be opened manually with the use of the socket driver. There are separate socket drives for the door raising/lowering mechanism, the pull-in hooks, and the latches.

Operating procedures for the normal electrical operation of the forward and aft cargo doors are outlined in the UAL Maintenance Manual (MM). Authorization for deferral of maintenance on the door power system is contained in the UAL B-747 Minimum Equipment List (MEL). In addition, operating procedures for dispatching aircraft with an inoperative door electrical power system (manual operation) are specified in the operator's MEL.

The UAL MM differs from Boeing's recommended MM. UAL had modified Boeing printed material or replaced pages with their own methods and procedures for conducting maintenance functions. The modifications to the manufacturer's MM were accepted by the FAA through "approval" by the FAA Principal Maintenance Inspector (PMI).3 Electrical cargo door open/close operations in the UAL and Boeing MM's are approximately the same, except the final "Caution" statement differs in methods to ensure that the latch cams are closed:

United Airlines Maintenance Manual

CAUTION DO NOT FORCE HANDLE. LATCH CAMS NOT FULLY CLOSED COULD CAUSE HANDLE MECHANISM SHEAR RIVET TO SHEAR.

Boeing Airplane Company Maintenance Manual

CAUTION DO NOT FORCE HANDLE. IF RESISTANCE IS FELT, CHECK LATCH ALIGNMENT STRIPES THROUGH VIEWING PORTS IN DOOR. LATCH CAMS NOT FULLY CLOSED COULD CAUSE HANDLE MECHANISM SHEAR RIVET TO SHEAR.

The following step in Boeing's MM does not appear in the UAL MM: "Check that the Cargo Door Warning Light on flight engineer panel goes out." The UAL flightcrew checklist includes a check of the warning light as part of the cockpit procedures for dispatch.

Prior to the issuance of AD-88-12-04 (see 1.6.8), UAL ramp service personnel only operated the cargo doors electrically. Manual operation was accomplished only by maintenance personnel. AD-88-12-04 required the additional procedure of recycling the master latch lock handle following manual operation of the latch actuator.

1.6.3 UAL Boeing 747 Special Procedures - Doors

The Safety Board's investigation revealed that UAL had published a "special maintenance procedure" in the UAL MEL for manual operation of the cargo door. The Maintenance Manual Special Procedures, 5-8-2-52, dated January 1988, were incorporated into UAL's MEL for use by maintenance controllers and work foremen in issuing instructions or procedures to mechanics. The procedure allowed the use of a special 1/2-inch socket drive wrench as the primary tool for use in manually opening or closing the cargo door. The document further authorized, as an alternate tool, an air-driven torque-limiting screwdriver. UAL procedures required approval by San Francisco Line Maintenance and the station maintenance coordinator before an air-driven screwdriver could be used to operate the doors of a B-747 airplane with an inoperative cargo door power system.

 At the Safety Board's public hearing, the FAA PMI and the FAA B-747 maintenance inspector for UAL testified that prior to the accident they were unaware of an FAA authorization for UAL's use of an air-driven torque-limiting screwdriver on B-747 cargo doors. However, the FAA's approval for the use of the tool was noted in the MEL section of the airline's maintenance manual. The original approval had occurred before the current inspectors assumed their respective positions. Both testified that they had not reviewed UAL's B-747 MEL because they assumed that the previous inspectors had reviewed it.

According to UAL, the calibration/adjustment for the torque-limited air-driven screwdrivers was tested every six months. Safety Board investigators found no records for the calibration/adjustment of the power tools used to manually open and close UAL B-747 cargo doors.

The Safety Board received statements from UAL supervisory maintenance personnel at all UAL stations and contract facilities for B-747 operations indicating that air-driven screwdrivers had not been used by maintenance personnel to open or close the forward cargo door on N4713U in the months prior to the accident.

1.6.4 UAL Maintenance Program

Airplanes operated by UAL are maintained under an FAA-approved continuous airworthiness maintenance program, as required by 14 CFR Part 121, Subpart L. The requirements of the UAL maintenance program are detailed in their Operations Specifications, dated November 21, 1988. Generally, UAL has an overall in-house capability to perform virtually all of the maintenance required on its own airframes and powerplants. All of the required major airframe and powerplant maintenance for N4713U had been performed at the UAL maintenance facility in San Francisco, California.

UAL's maintenance and inspection program is scheduled either at specific flight hour or calendar intervals. These maintenance and inspection programs are designated as: Service No. 1, Service No. 2, or A, B, C, MPV, and D Checks.

The work scope of Service Checks consists of a general inspection of the airplane and engines, including servicing of consumable fluids, oxygen, and tire pressures. The Service No. 1 check involves an inspection at each maintenance facility where the airplane lands. The Service No. 2 check is performed at a maintenance facility where the airplane is scheduled for at least 12 hours of ground time. The maximum time interval between Service No. 2 Checks is not to exceed 65 flight hours.

The "A" Check is performed at intervals not to exceed 350 flight hours. This check includes an extended inspection of the cockpit, cabin, cargo compartments, landing gear, tires, and brakes. It does not include a detailed inspection of the cargo doors.

The Phase Check ("B" Check) is scheduled on a calendar basis, not to exceed 131 days. The scope of the "B" Check contains items of inspection such as interior safety equipment and functional verification of various aircraft systems and components. It does not include a detailed inspection of the cargo doors.

The "C" Check is heavy maintenance oriented and is scheduled on a calendar basis, every 13 months. The "C" Check work scope is substantial and includes:

o structural inspection items;

o corrosion repair;

o prevention and inspection of critical flight control systems; and,

o a detailed inspection of the cargo doors.

The Mid-Period Visit (MPV) Check is a heavy maintenance inspection that is scheduled at intervals not to exceed 5 years. Items requiring scheduled overhaul are contained in the check as well as inspections of the airplane structure and interior.

The D Check, completes the routine scheduled B-747 maintenance plan and is scheduled at intervals not to exceed 9 years. The work scope is very similar to the MPV Check and consists of heavy maintenance to the airplane structure, landing gear, interior, and airplane systems, including the cargo doors.

1.6.5 Maintenance Records Review

A review of the airplane's history indicated that the forward and aft cargo doors were the original doors and neither had been removed for repair or replaced for cause. There was no record of major repair to either door or adjacent airplane structure.

The forward cargo door's forward mid-span latch pin had been removed because of gouging of the pin surface, during the last "C" check on November 28, 1988. According to the available maintenance documents, including the most recent "D" check, a full cargo door rigging check had not been accomplished. UAL maintenance personnel indicated that no rigging of the forward or aft cargo doors was required during the following checks:

1 "D" check accomplished April 1984;

2. "C" checks accomplished November 11, 1987, and November 28, 1988; and,

3. "B" checks accomplished March 21, 1988 and July 27, 1988;

The records prior to the "D" check in 1984 and the "C" check accomplished in November 1987 were not required to be retained. This procedure complies with FAR 121.380.

 The logbook of N4713U was reviewed and all numbered pages were in sequential order with none missing. The airplane had been released for flight by UAL, HNL Maintenance, in accordance with UAL procedures. The Los Angeles to HNL segment of flight 811, on February 23, 1989, generated four logbook discrepancy entries. All items were cleared by HNL maintenance and none were related to the cargo door. No new deferred items were generated and no current deferred items were corrected. The Maintenance Release document for flight 811 indicated that all deferred items were in accordance with the UAL Minimum Equipment List (MEL) and none referenced the forward cargo door.

UAL stores its maintenance information in an "electronic logbook," entitled Aircraft Maintenance Information System (AMIS). This system tracks on a daily and worldwide basis the flightcrew defect reports, all nonroutine maintenance defects, and maintenance corrective actions for the UAL airplane fleet. The system follows an Airline Transport Association (ATA) chapter format. According to UAL, the AMIS information is used as part of UAL's FAA approved maintenance reliability program affording the capability to assess trends at any given time.

A complete history of N4713U was reviewed for the following ATA Chapters:

Chapter-00-Miscellaneous

No significant items associated with the cargo door systems.

Chapter-21-Air Conditioning and Pressurization

An entry, dated August 19, 1988, indicated "Auto and Standby pressure controllers were erratic." UAL maintenance cleared this item as "Checked per Maintenance Manual Chapter (MM) 21-31-00."

Chapter-31-Instruments (Not related to any specific system)

No significant items associated with the cargo door systems.

Chapter-52-Doors (Cargo door section only)

During the period September 7, 1988, through November 1, 1988, a series of five discrepancies on the forward cargo door's electrical opening and closing system were noted. Ground handling personnel were required to operate the door by the manual system. On November 1, 1988, UAL maintenance corrective action for this discrepancy was signed off as, "replaced power unit [lift mechanism] per Maintenance Manual Chapter 52-34-02."

 An expanded AMIS history of the N4713U forward cargo door system was prepared beginning December 1, 1988, and continuing until the date of the accident. The history tracked the airplane by each flight and station transited.

During the period December 5, 1988, through December 23, 1988, eight defect reports regarding the opening and closing of the forward cargo door were entered into the system. The reported defects involved problems with the cargo door not always operating with the normal electrical system. Appendix E contains the details of the writeups and corrective actions.

During the period December 23, 1988, through February 23, 1989, two forward cargo door discrepancies were noted on N4713U. On January 3, 1989, the discrepancy was, "Manual lock seals broken." The corrective action was signed off as, "recycled [door] per placard on door and documented. No door problems." On January 15, 1989, the discrepancy was, "cargo door seal, lower aft corner is torn and loose from retainer." The corrective action was "repaired seal." There were no further recorded discrepancies.

On February 23, 1989, a written discrepancy noted "Aft cargo door damaged aft lower corner." The corrective action listed, "Interim repair per (EVA) LM-8-433. Accomplish permanent repair within 60 flight hours."

Chapter-53-Structures (Fuselage)

During the period March 1988, through February 24, 1989, one defect was noted for each of the forward and aft cargo doors on N4713U.

Forward Cargo Door.--On September 6, 1988, the discrepancy was, "Approximately six inches of forward cargo door jamb damaged center of lower side sealing surface." The corrective action was, "Installed doubler and sealed area."

Aft Cargo Door.--On April 22, 1988, the discrepancy was, "Aft cargo door rear sill latch does not spring up to lock." The corrective action was, "Replaced latch."

1.6.6 Service Difficulty Report Information

A review was made of the Service Difficulty Reports (SDRs) for ATA Chapter 52 for all UAL Boeing 747 airplanes. Thirty-nine SDRs were recorded over the period January 31, 1983, through March 21, 1989. The following summarizes data concerning the forward and aft cargo doors:

o 6 cases of corrosion;

o 13 cases of cracking;

o 9 cases of door open (false) indications;

o 8 cases where cabin did not pressurize;

o 2 cases of cabin pressure loss; and

o 1 case of dent caused by ground equipment.

 None of the noted SDR cases were related to or recorded for N4713U.

1.6.7 Service Letters and Service Bulletins

Boeing issues information to its customers via Service Letters (SL's) and Service Bulletins (SB's) to inform operators of reported and anticipated difficulties with various airplane models. Twelve SL's provided guidance for maintenance or information applicable to the B-747 cargo doors. Twenty-nine SB's provided guidance for maintenance or information applicable to the B-747 cargo door.

SB-747-52-2097, "Pressure Relief Door Shroud Installation--Lower Lobe and Side Cargo Doors," was issued on June 27, 1975. Revision 1 to SB-747-52-2097 was issued November 14, 1975. In general, the SB recommended the installation of shrouds on the inboard sides of the cargo door pressure relief door openings. The purpose of the shrouds was to prevent the possibility of the pressure relief doors being rotated (blown) to the closed position during the pressurization cycle. This condition could only occur if the master latch lock handle had been left open and the flightcrew failed to note the cargo door open warning before takeoff.

UAL records for N4713U indicated that SB-747-52-2097 had been complied with and the shrouds had been installed on the forward and aft cargo doors. However, examination of the aft cargo door on N4713U revealed that the shrouds were not in place. Because the forward door has not been recovered, it could not be determined whether the shrouds were in place on the forward door. UAL could not find records to verify if they were installed, or if they had been removed from either door.

1.6.8 Airworthiness Directives

There had been 141 Airworthiness Directives (ADs) issued that were applicable to the accident airplane. Two ADs were pertinent to the cargo door. AD 79-17-02-R2 ("Inspection of Fore and Aft Lower Cargo Door Sill Latch Support Fittings,") required an inspection every 1,700 flight hours. The second, AD 88-12-04 ("To Insure That Inadvertent Opening Of The Lower Cargo Door Will Not Occur In Flight,") issued on May 13, 1988, required an initial one time inspection of the cargo door latch locking mechanisms within 30 days of issuance of the AD, and certain repetitive inspections until terminating action for the AD was taken.

The circumstances of a Pan American World Airways (Pan Am), Boeing 747-122 cargo door opening in flight (see 1.17.1 for details) led to the issuance of Boeing Alert Service Bulletins (ASB) 52A2206 on April 8, 1987, and 52A2209 on August 27, 1987, entitled, "Doors - Cargo Doors Lower Lobe Forward and Aft Cargo Doors, Latch Locking System Tests, Operation and Modification." Tests and investigation revealed that latch lock sectors would, in some instances, not restrain the latch cams from being driven open manually or electrically. Movement of the latch cams without first moving the lock sectors to the stowed [unlocked] position would cause bending, gouging, and breaking of the sectors. The FAA issued AD-88-12-04 to make the provisions of SB's 52A2206 and 52A2209 mandatory.

 The terminating action for AD 88-12-04 called for installing steel doublers to add strength to the lock sectors to prevent the latch cams from being able to be driven to the open position manually or electrically with the sectors in the locked position. AD 88-12-04 also required that, if the door could not be operated normally (electrically), a trained and qualified mechanic was to open and close the door manually, rather than ramp service personnel. Further, the AD required an inspection of the lock sectors for damage once a cargo door was restored to electrical operation after any malfunction had required manual operation of the door.

The amount of time allowed for completion of terminating action portion of AD 88-12-04 was either 18 months or 24 months, from the issue date of the AD, depending on Boeing 747 model series. Terminating action for the AD had not been accomplished on N4713U prior to the accident, nor was it required since, for this airplane, the deadline for compliance with the terminating action was January 1990. According to UAL, N4713U was scheduled for completion of the terminating action in April 1989, when the airplane was scheduled for other heavy maintenance.

During the Safety Board's investigation it was determined that a clerical error was made by UAL personnel, while attempting to expedite the processing of an advanced copy of a Notice of Proposed Rule Making (NPRM 87-NM-148-AD), preceding AD 88-12-04. The error involved the dropping of one line of text during the typing of the document. Because of that error, the portion of the text of the NPRM (and the final text of the AD) that was left out of UAL's maintenance procedures required an inspection of the B-747 cargo door lock sectors every time a cargo door was restored to its normal (electrical) operation after manual operation was required.

The UAL maintenance internal auditing system, including quality assurance personnel, did not detect the omission until after the accident. UAL personnel stated that, for unknown reasons, no one within the maintenance or quality assurance programs had reviewed the final AD language for comparison with the UAL maintenance procedure.

A review by Safety Board investigators of forms used by UAL to verify compliance with applicable FAA AD's issued indicated that all of the mandatory and applicable ADs were satisfied within their specified time limits. The list provided by UAL to the FAA as part of the FAA's oversight responsibilities showed compliance with AD-88-12-04, with the exception of the terminating action.

1.7 Meteorological Information

The accident occurred in night visual meteorological conditions. No adverse weather was experienced, although the flight did have to deviate around thunderstorms during the descent.

1.8 Aids to Navigation

There were no navigational problems.

 1.9 Communications

There were no radio communication difficulties between flight 811 and ATC. Members of the flightcrew did not have any difficulty in verbally communicating with each other; however, attempts to communicate with the cabin crewmembers by interphone were unsuccessful following the explosive decompression.

1.10 Aerodrome Information

After the explosive decompression, the airplane returned to HNL, a 14 CFR Part 139 certificated airport on the island of Oahu, Hawaii. The airport is located about 4 miles west of Honolulu, Hawaii.

HNL is a "joint use" airport that is used by the State of Hawaii, the U.S. Air Force, general aviation, commercial, air carrier, air taxi, and military aircraft. Aircraft Rescue and Fire Fighting (ARFF) services are provided by State and Hickam Air Force Base ARFF units. Prior to the emergency landing at Honolulu, flight 811 requested that all available rescue and medical equipment to be on hand when they landed. When the crash alarm was broadcast, all civilian and military fire units responded and were in position in 1-minute at pre-designated stations at runway 8 left.

The Safety Board's investigation revealed that there was no direct radio communications between the State Airport vehicles and Hickam ARFF vehicles. Because there were no direct radio communication's, the Chief of the airport's units had to drive his vehicle to the vehicle of the Chief of the Hickam units to coordinate the positioning of ARFF units prior to the landing of United 811.

The Hickam vehicles are painted olive drab camouflage. During the response, the Chief of the State ARFF vehicles observed a near collision between a State and a Hickam vehicle. He attributed this to the camouflaged Hickam vehicle not being visually conspicuous. The response took place on a moonless night and in light rain.

1.11 Flight Recorders

The airplane was equipped with a Sundstrand model 573 digital type Flight Data Recorder (DFDR) and a Sundstrand model AV557-B Cockpit Voice Recorder (CVR).

Examination of the data plotted from the DFDR indicated that the flight was normal from liftoff to the accident. The recorder operated normally during the period. However, the decompression event caused a data loss of approximately 2 1/2 seconds. When the data resumed being recorded, all values appeared valid with the exception of the pitch and roll parameters. Lateral acceleration showed a sharp increase immediately following the decompression. Vertical acceleration showed a sharp, rapid change just after the decompression and a slight increase as the airplane began its descent.

 The CVR revealed normal communication before the decompression. At 0209:09:2 HST, a loud bang could be heard on the CVR. The loud bang was about 1.5 seconds after a "thump" was heard on the CVR for which one of the flightcrew made a comment. The electrical power to the CVR was lost for approximately 21.4 seconds following this sound. The CVR returned to normal operation at 0209:29 HST, and cockpit conversation continued to be recorded in a normal manner.

1.12 Wreckage and Impact Information

An extensive air and surface search of the ocean failed to locate the portions of the airplane lost during the explosive decompression. The Safety Board continues work with the U.S. Navy for a possible attempt to locate and recover the cargo door for examination.

1.13 Medical and Pathological Information

Appendix D contains a list of injuries.

1.14 Fire

There was no fire in the cabin or fuselage. The fires in engines No. 3 and 4 were extinguished after the engines were shut down.

1.15 Survival Aspects

The fatal injuries were the result of the explosive nature of the decompression, which swept nine of the passengers from the airplane.

At 0210, the FAA notified the U.S. Coast Guard that a United Airlines, Inc., B-747, with a possible bomb on board, had experienced an explosion and was returning to HNL. The Coast Guard Cutter, CAPE CORWIN, departed Maui at 0248 to search the area for debris and the missing passengers. Ultimately, 4 shore commands, 13 surface/air units, and approximately 1,000 persons took part in the combined search and rescue (SAR) operation. The search was terminated at 1200 on February 26, 1989, without recovery of any passenger bodies.

The flight attendants had approximately 20 minutes to prepare the cabin and the passengers for an imminent ocean ditching, and subsequently, for an emergency evacuation. During the 20 minutes they attended to injured flight attendants and passengers, attached the face masks to their emergency oxygen bottles, helped each other don life preservers, helped numerous passengers don life preservers, held up safety cards and life vests to call attention to these items for passengers to use, briefed "helper" passengers to assist in the evacuation, cleared debris away from the exit doors and aisles, closed the doors of the storage compartment above doors 2 left and 2 right, prepared the cabin for an emergency evacuation, and told the passengers to brace for impact.

 Several problems were experienced by the flight attendants and the passengers following the decompression, while preparing for a possible ditching, and preparing for the emergency evacuation. These problems included attempts by flight attendants to connect face masks to their portable oxygen bottles, the lack of a sufficient number of megaphones, limited visibility from a flight attendant seat, overhead storage compartment doors opening, and donning and fastening life preservers.

Federal Aviation Regulation 14 CFR 25.1447 (c)(4) requires that "portable oxygen equipment must be immediately available for each cabin attendant." Those portable oxygen bottles on N4713U, which were readily available, were not immediately usable because the masks were not attached to the regulators. The flight attendants reported difficulties in attaching the masks to the regulators.

The aft purser ran back to the flight attendant jumpseat at door 5-left for a portable oxygen bottle. However, she found no bottle at this location (none was installed). She then ran back to the 4-left jumpseat, by which time she was "light headed." After the aft purser reached jumpseat 4-left, flight attendant No. 14, who was already sitting there, placed an oxygen mask on her face. The aft purser further stated, "considering the fact that in this case there was no other available source of oxygen, you can't imagine how horrible I felt going back there needing oxygen but finding no oxygen bottle at 5-left. It was terrifying."

A portable emergency oxygen bottle was not required to be stowed at the flight attendant seat at exit 5-right; however, one was stowed in the right coat closet behind the flight attendant seat. In addition, the left side closet and rest rooms were physically separated from the right side closet and rest rooms. This arrangement requires a flight attendant, who was seated at exit 5-left to walk around to the right side of the cabin to obtain the oxygen bottle.

Communication between the flight attendants and passengers was very difficult because of the high ambient noise level in the cabin after the decompression, even though the public address (PA) system was operational. Flight attendants were located at each of the 10 exit doors, yet there were only two megaphones required to be on the airplane; one located at door 1-left and another located a 4-left.

The flight attendants, who were responsible for each of these two doors, used the megaphones to broadcast commands to passengers in their immediate areas and to other flight attendants in preparation for the landing and subsequent evacuation. The other 13 flight attendants (including the one deadheading flight attendant) had to shout, use hand signals, and show passengers how to prepare for the evacuation by holding up passenger safety cards, so passengers could review the information and also know how to put on their life preservers.

As soon as the decompression occurred, the flight attendant in the upper deck business class section went to her jumpseat and donned her oxygen mask, life preserver, and restraint system. While she waited for instructions, and because of intense cabin noise she had to communicate with passengers by holding up a safety card and a life preserver. Passengers sitting in the front rows, in turn, showed safety cards and life preservers to other passengers seated behind them. Eventually everyone understood that they were to read the safety card and put on their preservers. However, the 5 foot 3 1/2 inch flight attendant stated that her jumpseat was so low that she could not directly observe the passengers in the 4th (last row).

A two door overhead stowage compartment that had formerly stored a life raft was located above each exit door. These compartments contained blankets and passenger carry-on luggage. At doors 2-left and 2-right the doors of each compartment had opened downward and blocked each exit. Also the contents of the compartments fell to the floor at the exits. The doors had to be closed before the evacuation because they partially blocked the exit.

The chief purser was not able to tighten the life preserver's two straps around her waist and needed the deadheading flight attendant to tighten them for her. Several flight attendants and passengers had difficulties connecting the two straps around their waists. One flight attendant helped about 36 passengers don their preservers.

Safety Board investigators and United Airlines personnel examined several life preservers from each of the types of preservers produced by five manufacturers. The strap of one manufacturer's preserver was very difficult to tighten around the waist while another from the same manufacturer was easy to tighten. The two vests had different strap material and strap adjustment fittings. Also, the straps are very difficult, if not impossible, to tighten when they are pulled at an acute angle from the wearer's body, i.e. from about 45 to 70 degrees. Holding the hands and straps closer to the waist facilitates easier adjustment of the straps.

1.16 Tests and Research

1.16.1 Forward Cargo Door Electrical Component Examinations

Several electrical components associated with the operation of the forward cargo door from N4713U were examined on the airplane and then were removed for further testing. These components included the No. 2 ground handling power bus relay, the air/ground safety relay, the No. 1 auxiliary power circuit breaker, and the outside and inside door control switches. All of these components were tested for both single faults and intermittent failures. The test results showed that all of the switches/relays were functional, although a loose wire connection was found on the outside door control switch. This loose wire connection showed evidence of overheated insulation on the two terminal lugs that attach to terminal No. 5, and there was evidence of a burn (arc point) on the top of the screw head for terminal No. 5. Terminal No. 5 is associated with power for the door "close" cycle, and not the door "open" cycle.

 An electrical continuity check was performed on the cockpit cargo door warning light system components that remained with the airplane. This check confirmed the integrity of the circuit from the door area to the cockpit. The examination of the two bulbs that comprise the forward cargo door warning light revealed that one bulb was inoperative. The other bulb, which is in parallel with the inoperative bulb, was found operative. The display legend, which reads, "FWD CARGO DR," on the flight engineer's panel was illuminated for the most part, even with one bulb inoperative.

A functional check of the circuit, which allows the cockpit warning lights to be dimmed during night operations, was also performed. The check consisted of removing the card containing this circuit and installing it in another B-747. The test was satisfactory in that the dim/bright circuit functioned properly.

1.16.2 Pressurization System

The pressure relief valves located on the left side of the fuselage in the forward cargo compartment were removed from the airplane and subjected to bench tests at the UAL maintenance facility in San Francisco, California. No significant anomalies were discovered and both valves performed within specified tolerances.

1.16.3 Safety Board Materials Laboratory Examinations--Cargo Door Hardware

The following forward cargo door closing and latching components were returned to the Safety Board's Materials Laboratory for analysis.

o Eight latch pins with pin housings from the lower sill of the door body cutout;

o Two pull-in hook pins, one from the lower end of the forward side of the door body cutout forward frame, and one from the lower end of the aft side of the body cutout aft frame, with housings;

o Two mid-span pins, one from the forward side of the door body cutout forward frame, and one from the aft side of the door body cutout aft frame.

All components were initially examined while installedÅ  on the airplane. All eight forward cargo door latch pins, with housings, were removed for further laboratory examination. Also, for comparison, one of the latch pins, with housing, from the aft cargo door was also removed. For orientation purposes, the eight lower latch pin assemblies are referred to by number, with the No. 1 latch pin being the most forward on the lower door sill, and the No. 8 pin being the most aft. When referencing a circumferential location on the latch pins or mid-span pins, a clock position was used. The clock code was oriented looking forward with 12 o'clock being straight up and 9 o'clock being directly inboard.

 Based on the orientation of the latching mechanisms, the fully unlatched latching cams would first contact the latch pins from about the 1:15 o'clock position to the 7:15 position as the door was closed. As the cams are being latched around the pins, they would rotate approximately 80(, making contact with the pins from about the 4:15 position to the 10:15 position (See Figure 6).

Detailed examination of the exposed surface of the pins (the portion of the pins extending from the housings) revealed various types of wear and damage.

In general, all of the forward door cargo latch pins had smooth wear over the entire portion of the pin area contacted by the cams during normal closing and opening of the door. The pins also had distinct roughened (smeared) areas between the 6:15 and the 7:30 positions (See Figure 7). The roughened areas had evidence of "heat tinting" and transfer of cam material to the surface of the pins. On pins 1 and 8 the roughened areas extended past the pin bottom to the 5:00 position. The 7:30 position approximately corresponds to the area on the pin where the lower surface of the cam would be relative to the pin when the latch cams are in the unlatched or nearly unlatched position.

The forward pull-in hook pin was not significantly bent, but the structure to which it was attached was deformed outward, so the hook pin was deflected significantly outward. Three of the four bolts holding the aft pull-in hook pin had sheared, so the hook pin was also deflected outward. Both hook pin ends were damaged, but neither pin was significantly deformed along its length. There was significant heat tinting on the damaged area of the forward hook pin. Boeing engineering calculations determined that the pull-in hook pins would fail at a 3.5 psi differential cabin pressure with the latch cams unlatched.

The forward mid-span latch pin was relatively undamaged. The aft mid-span latch pin had definite areas of damage. Both pins had wear areas where the cams would contact the pins during latching.

1.16.4 General Inspection of Other UAL Airplanes

During the on-scene phase of the investigation, the Safety Board investigators examined six other B-747 airplanes while they were on the ground at HNL (four UAL airplanes and two operated by other carriers) to observe routine cargo door operations and to assess the condition of latching components. Generally, the door operations were normal. During the examination of latch pins on these airplanes, it was noted that most had a smooth wear ridge at the 9:00 position (looking forward) or were undamaged. All wear areas on the pins were smooth.

 During electrical operation of the aft cargo door on one of the other UAL B-747 airplanes (N4718U), the pull-in hooks did not pull the door fully closed and the latch cams completed the closure. During operation of the latch cams, the bottom of the door moved, first circumferentially downward and then inboard. This additional movement was approximately 1/4 inch. A definite "thunking" noise was discernible as the door moved to its closed position at the end of cam rotation. On one occasion, the door would not open under electrical power. The door was "kicked" by a UAL mechanic, power was reapplied, and the door opened properly. Examination of the door by UAL mechanics, disclosed that the riveted plate holding the aft pull-in hook switch striker was loose.

All eight lower latch pins for the forward cargo door on N4718U exhibited a smooth ridge near the 9:00 position. Pins No. 1 and 2 also showed a smooth ridge at the 6:30 position with a smooth wear area between the 6:30 and 9:00 position. The forward and aft midspan cams of both forward and aft cargo doors had a heavy gouge mark corresponding to the end of the midspan latch pin.

N4718U was subsequently removed from service for repair of the aft cargo door latching mechanisms.

1.17 Additional Information

1.17.1 Previous Cargo Door Incident

On March 10, 1987, a Pan American Airways B-747-122, N740PA, operating as flight 125 from London to New York, experienced an incident involving the forward cargo door. According to Pan Am and Boeing officials who investigated this incident, the flightcrew experienced pressurization problems as the airplane was climbing through about 20,000 feet. The crew began a descent and the pressurization problem ceased about 15,000 feet. The crew began to climb again, but about 20,000 feet, the cabin altitude began to rise rapidly again. The flight returned to London.

When the airplane was examined on the ground, the forward cargo door was found open about 1 1/2 inches along the bottom with the latch cams unlatched and the master latch lock handle closed. The cockpit cargo door warning light was off.

According to the persons who examined the airplane, the cargo door had been closed manually and the manual master latch lock handle was stowed, in turn closing the pressure relief doors and extinguishing the cockpit cargo door warning light. Subsequent investigation on N740PA revealed that the latch lock sectors had been damaged and would not restrain the latch cams from being driven open electrically or manually. It was concluded by Boeing and Pan Am that the ground service person who closed the cargo door apparently had back-driven (opened) the latches manually after the door had been closed and locked. The damage to the sectors, and the absence of other mechanical or electrical failures supported this conclusion.

 Further testing of the door components from N740PA and attempts to recreate the events that led to the door opening in flight revealed that the lock sectors, even in their damaged condition, prevented the master latch lock handle from being stowed, until the latch cams had been rotated to within 20 turns (using the manual 1/2 inch socket drive) of being fully closed. A full cycle, from closed to open, is about 95 turns with the manual drive system.

1.17.2 FAA Surveillance of UAL Maintenance

The Denver, Colorado, FAA Flight Standards District Office (FSDO) holds the operating certificate for United Airlines, Inc. The FAA FSDO in San Francisco, California, has the primary surveillance and oversight responsibility for UAL maintenance.

The FAA's PMI has the responsibility to oversee an airline's compliance with Federal Regulations with respect to maintenance, preventive maintenance, and alteration programs. The PMI determines the need for, and then establishes work programs for, surveillance and inspection of the airline to assure adherence to the applicable regulations. A portion of the PMIs position description reads as follows:

Provides guidance to the assigned air carrier in the development of required maintenance manuals and recordkeeping systems. Reviews and determines adequacy of manuals associated with the air carrier's maintenance programs and revisions thereto. Assures that manuals and revisions comply with regulatory requirements, prescribe safe practices, and furnish clear and specific instructions governing maintenance programs. Approves operations specifications and amendments thereto.

Determines if overhaul and inspection time limitations warrant revision.

Determines if the air carrier's training program meets the requirements of the FARs, is compatible with the maintenance program, is properly organized and effectively conducted, and results in trained and competent personnel.

Directs the inspection and surveillance of the air carrier's continuous airworthiness maintenance program. Monitors all phases of the air carrier's maintenance operation, including the following: maintenance, engineering, quality control, production control, training, and reliability programs.

At the Safety Board's public hearing on this accident, the PMI for United Airlines at the time of the flight 811 accident stated that he was trained as an FAA air carrier inspector and had been assigned to United Airlines since November 25, 1985. In addition to attending the normal FAA indoctrination course, he had received training in accident investigation, compliance  enforcement, nondestructive testing, enforcement, and composite materials. To qualify for the position of PMI, he had completed a 3-week management training course at Lawton, Oklahoma. This was supplemented by a 2-week course on management training systems.

According to the PMI, FAA surveillance of UAL B-747 maintenance activities was organized around the daily work schedule of the FAA air safety inspector, specifically assigned to the UAL B-747 fleet by the PMI. The schedule for surveillance is normally prepared a year in advance by the FAA computerized Work Planning Management System (WPMS). Each FAA inspector is assigned specific responsibilities in the surveillance and monitoring of the airplane fleet to which he is assigned.

The PMI stated that assigned inspectors conducted surveillance of the UAL airplanes while they were in light or heavy maintenance and when they were released to service or in the process of preparing for a flight. Post-flight surveillance was also performed. He said, as a routine, the inspectors visually inspected the airplanes and reviewed the airplane log records either during en route checks, while in flight, or upon termination of various flights. He said that inspectors conduct spot ramp inspections; however, they do not routinely observe ramp service operations as part of the surveillance program.

He said that FAA inspectors are not required to inspect the airplanes, but merely are to observe ramp service activities. Deficiencies or malfunctions were to be noted. The assigned inspector or the PMI would then report these observations to the UAL quality assurance liaison person or directly to UAL management.

The PMI stated that the FAA had conducted five special surveillance inspections of UAL in the previous 3 years and 5 months. The last special inspection, an MEL Survey Inspection, was completed in 1988. That inspection primarily addressed how many deferred maintenance items were being carried or deferred on each aircraft during a specified time period.

The PMI stated that his office does not approve the method by which the carrier complies with an AD, unless specified in the AD. However, a scheduled surveillance method was in place to review the carrier's AD compliance process and the ADs applicable to certain fleets. Each assigned inspector had a schedule for performing this oversight in his work program. The PMI or his staff review a monthly report from the carrier listing ADs applicable to a particular fleet and their compliance. The FAA's surveillance of the carrier's AD compliance process involved a review of this list, not actual shop visits to verify compliance.

The inspector assigned to the UAL B-747 fleet stated that approximately 30 percent of his time was spent on actual ramp maintenance surveillance. Other activities included: en route inspections, station inspections, meetings, classes and administrative paper work. Spot ramp inspections were scheduled as a normal routine, as well as by mandate in a particular AD.

 The PMI stated that foreign contract maintenance bases were inspected once a year at a minimum. The PMI had the prerogative to use geographical surveillance inspectors (inspectors from other FAA offices), or inspectors from his office more familiar with UAL maintenance procedures to conduct inspections or investigations.

The PMI and the B-747 maintenance inspector assigned to UAL testified that, prior to this accident, they were not aware of any problems involving the operation of B-747 cargo doors, including the problems reported with N4713U during December 1988. The PMI testified that he could always use more inspectors to "conduct more in-depth surveillance and monitor UAL's fleet more adequately."

The extensive documentation of maintenance performed on UAL B-747 airplanes was forwarded to the PMI's official library by US mail. The data were ultimately channeled to the B-747 maintenance inspector. The PMI and maintenance inspector testified that the voluminous paperwork and work schedules precluded their monitoring the information to determine trends on problem areas.

1.17.3 Corrective Actions

On March 31, 1989, the FAA issued telegraphic (AD) ADT 89-05-54. This AD superseded AD 88-12-04 and required certain procedures to be accomplished when operating the cargo doors. These included: confidence checks of the door mechanical and electrical systems, inspections of the door locking mechanisms, and repairs if necessary. The AD also accelerated the schedule for terminating action to place steel doublers on the latch lock sectors, and it reinstitued the procedures for using the eight view ports to verify the position of the latch cams, after the door is latched and locked.

The FAA, in conjunction with the Air Transport Association, the manufacturers, and other interested parties are collectively working to address the human factor issues in the readability and understandability of ADs and SBs by line maintenance personnel. They are also reviewing the entire range of design, maintenance, and operation of outward opening doors to develop advisory information for pertinent parties.

FAA representatives stated at the Safety Board's public hearing that the FAA is increasing their operations and airworthiness inspector staffing by approximately 1,000 new hires in the next 3 fiscal years.

The PMI for UAL at the time of the accident stated at the Safety Board's public hearing that, as a result of the accident, "we have intensified our surveillance on the cargo door activities to the point where the assigned inspectors and inspectors who are not assigned to that particular fleet, 747s, are doing night surveillance, early morning surveillance, and we have intensified our surveillance on the cargo door in watching the operation of the cargo door to comply with the Airworthiness Directive."

 On August 23, 1989, the Safety Board issued three safety recommendations (A-89-92 through -94) to the FAA. The recommendations urged the FAA to:

Issue an Airworthiness Directive (AD) to require that the manual drive units and electrical actuators for Boeing 747 cargo doors have torque limiting devices to ensure that the lock sectors, modified per AD-88-12-04, cannot be overridden during mechanical or electrical operation of the latch cams.

Issue an Airworthiness Directive (AD) for non-plug cargo doors on all transport category airplanes requiring the installation of positive indicators to ground personnel and flightcrews confirming the actual position of both the latch cams and locks, independently.

Require that fail-safe design considerations for non-plug cargo doors on present and future transport category airplanes account for conceivable human errors in addition to electrical and mechanical malfunctions.

Section 4.0 contains the FAA's response to the recommendations and the status of the followup actions.

On October 12, 1989, the FAA issued NPRM 89-NM-148-AD, which proposed the amendment of ADT-89-05-54. The proposed revisions would require modification of the warning systems for the forward and aft cargo door, and the main deck cargo door, if installed. The modifications would provide visual warnings to flightcrew and ground crew when the doors are not fully closed, the latch cams are not rotated to the closed position, or the lock sectors are not in the locked position. Further, the source for the warning signal would monitor the position of the latch cams. Public comments for the NPRM were due by December 27, 1989.

Boeing has completed tests that have verified the integrity of the upgraded latch lock sectors to prove that the latch cams cannot be back-driven through the lock sectors mechanically or electrically. Boeing also has been conducting tests on the B-747 cargo door to evaluate the effects of unrepaired damage and abuse on the latch/lock system. The tests, which are scheduled for completion in April 1990, will help to develop further the allowable damage limits on the latch lock system and mechanism support structures. Additionally, Boeing is conducting tests to evaluate any unlatching tendencies under cabin pressure loads. These tests, scheduled for completion in August 1990, will include the measurement of loads in the latch system as the latch cams are rotated incrementally from the fully latched position to the unlatched position under pressurization loads.

1.17.4 Boeing 747 Cargo Door Certification

Title 14 CFR 25.783, Amendment 25-15, effective October 24, 1967, was the original certification basis for Boeing 747 cargo doors. Specifically, Part 25.783 (e) and (f) applied to  doors for which the initial opening movement is outward (non-plug type doors). Those rules specified that:

(e) There must be a provision for direct visual inspection of the locking mechanism by crewmembers to determine whether external doors, for which the initial opening movement is outward (including passenger, crew, service, and cargo doors), are fully locked. In addition, there must be a visual means to signal to appropriate crewmembers when normally used external doors are closed and fully locked.

(f) Cargo and service doors not suitable for use as an exit in an emergency need only meet paragraph (e) of this section and be safeguarded against opening in flight as a result of mechanical failure.

Amendment 25-23, effective May 8, 1970, added the following text to paragraph (f): "...or failure of a single structural element." Amendment 25-23 did not apply to the initial certification basis for the B-747.

Amendment 25-54, effective October 14, 1980, expanded Part 25.783 (e), (f), and (g) to read:

(e) There must be a provision for direct visual inspection of the locking mechanism to determine if external doors, for which the initial opening movement is not inward (including passenger, crew, service and cargo doors), are fully closed and locked. The provision must be discernible under operational lighting conditions by appropriate crewmembers using a flashlight or equivalent lighting source. In addition, there must be a visual warning means to signal the appropriate flight crewmembers if any external door is not fully closed and locked. The means must be designed such that any failure or combination of failures that would result in an erroneous closed and locked indication is improbable for doors for which the initial opening movement is not inward.

(f) External doors must have provisions to prevent the initiation of pressurization of the airplane to an unsafe level if the door is not fully closed and locked. In addition, it must be shown by safety analysis that inadvertent opening is extremely improbable.

(g) Cargo and service doors not suitable for use as an exit in an emergency need only meet paragraph (e) of this section and be safeguarded against opening in flight as a result of mechanical failure or failure of a single structural element.

At the Safety Board's public hearing, the FAA and the Boeing representatives acknowledged that during certification of the Boeing 747 the loss of a lower lobe cargo door was not considered to be an "acceptable event." Therefore, redundant mechanical devices and  operational procedures were incorporated to protect against loss of the door in flight. Initial FAA certification approval of the Boeing cargo door design and operation included the installation and use of eight view ports on the door for ground personnel to observe the alignment of paint stripes on the latch cams with arrows on the latch pin support fitting, thereby, complying with the requirements of 14 CFR 25.783(e), which require a ". . . provision for direct visual inspection of the door locking mechanism . . .," to determine if the door is closed and locked.

In correspondence dated November 24, 1969, and May 15, 1970, Boeing requested that the FAA approve the use of a visual inspection of the pressure relief doors of the cargo doors as an alternate method for determining the locked condition of the door. This design also provided a visual indication to the flightcrew via the cargo door warning light on the flight engineer's warning light annunciator panel. Boeing's request stated that this means of compliance ". . . provides a simpler check whereby only the pressure relief doors need to be checked . . .," by the ground crew, in lieu of actually observing the latch cams and alignment stripes through the eight view ports. Boeing also provided a Failure Analysis to support its request. The conclusion of the Failure Analysis reads: "Any failure, mechanical or electrical, within the latching system which results in open latches will always be indicated by open pressure relief doors." The FAA approved their alternate method on June 8, 1970. Subsequently, the procedures for maintaining the view ports and the alignment stripes in a serviceable condition, which had been included in the UAL MM were removed. Also, the provision for observing the alignment stripes as part of the door closing procedure were not required for B-747 airline operators.

At the Safety Board's public hearing, a Boeing witness, in answer to a question relative to Boeing's possible consideration of modifications or design changes to the B-747 cargo door indication system to install a position switch directly on the latch cams, stated, "We are looking into the best possible designs that would provide indication on the cams and door closed, both exterior to the aircraft and in the flight deck. We are going to look into that.... However, we want to achieve the required indication in the most reliable method and we have not yet determined what that will be, or any changes (that) are necessary, or would make it more reliable than the way the system operates currently."

1.17.5 Advisory Circular AC 25.783-1

Advisory Circular (AC) 25.783-1 was issued December 10, 1986, on the subject, "Fuselage Doors, Hatches, and Exits." AC 25.783-1 set forth the acceptable means of compliance with the provisions of Part 25 of the FAR's dealing with the certification of fuselage doors. Specifically, it provides for an acceptable method for showing compliance with the provisions of Part 25.783, Amendment 25-54.

Neither the provisions of Part 25.783, Amendment 25-54, nor the guidelines of AC 25.783-1 were part of the certification basis of the Boeing 747.

 2. ANALYSIS

2.1 General

The flightcrew and flight attendants were trained and qualified in accordance with the applicable Federal regulations and UAL standards and requirements. There were no air traffic control or weather factors related to the cause of this accident.

The airplane had been properly maintained, with the exception of certain requirements pertaining to the cargo doors. Those discrepancies will be discussed in detail in this analysis.

The evidence examined by the Safety Board during its investigation revealed conclusively that this accident was precipitated by the sudden loss of the forward lower lobe cargo door, which led to an explosive decompression. There was no evidence of preexisting metal fatigue or corrosion in the structure surrounding the cargo door. All breaks were the result of overload at the time of the loss of the door. There was no evidence of a bomb or similar device that caused an explosion on the airplane.

The explosive decompression of the cabin when the cargo door separated caused the nine fatalities. The floor structure and seats where the nine fatally injured passengers had been seated were subjected to the destructive forces of the decompression and the passengers were lost through the hole in the fuselage. Their remains were not recovered. Most of the injuries sustained by the survivors were caused by the events associated with the decompression, such as baro-trauma to ears, and cuts and abrasions from the flying debris in the cabin. Other injuries were incurred during the emergency evacuation.

The loss of power to the Nos. 3 and 4 engines was caused by foreign object damage when debris was ejected from the cargo compartment and cabin during the explosive decompression. The debris also caused damage to the right wing leading edge flap pneumatic ducting, and other areas along the right side and empennage of the airplane.

During the approach to HNL, all of the leading edge flaps had extended, except the outboard sections 22 through 26 on the right wing. The reason that they failed to extend probably was the damage to the pneumatic duct caused by the ejected debris. The pneumatic pressure probably was too low to actuate the most outboard flaps to the extended position.

The failure of the flightcrew and passenger oxygen systems was caused by structural deformation and damage to the supply lines in the area adjacent to the cargo door and failed fuselage structure.

The Safety Board's analysis of this accident concentrated on the reasons for the loss of the cargo door and the events that led to its loss in flight. The analysis included an evaluation of the design, certification, and approval processes for the B-747 cargo doors, and the operational,  maintenance, and inspection processes for the doors. Also, the analysis included an evaluation of the historical events that had occurred over the past months and years that eventually led to this accident.

2.2 Loss of the Cargo Door

The calculated pressure differential at the time of the loss was about 6.5 psi, which would have exerted a load on a properly closed and locked door that was substantial, but well within design limits.

There was no evidence of a structural problem with the cargo door that could have caused it to fail from metal fatigue or corrosion. The evidence showed that the door was intact when it opened. That is, deformation to the latch pins and pull-in hooks and the damage to the cabin floor structure near the upper door hinge area, as well as the damage to the structure surrounding the door, showed that it came off intact, and did not break into two or more pieces. The damage to the cabin floor beam structure, adjacent to the cargo door hinge area, showed that decompression loads in the cabin broke the beams downward when pressure was released from the cargo compartment. The fuselage skin above the door was torn away during the decompression as the door separated violently from the airplane.

There are no reasonable means by which the door locking and latching mechanisms could open mechanically in flight from a properly closed and locked position. If the lock sectors were in proper condition, and were properly situated over the closed latch cams, the lock sectors had sufficient strength to prevent the cams from vibrating to the open position during ground operation and flight. However, there are two possible means by which the cargo door could open while in flight. Either, the latching mechanisms were forced open electrically through the lock sectors after the door was secured, or the door was not properly latched and locked before departure. Then the door opened when the pressurization loads reached a point that the latches could not hold.

2.3 Partially Closed Door

Examination of the eight latch pins that had been removed from the lower sill of the forward cargo door revealed smooth wear patterns where the latch cams had normally rotated around the pins. These wear patterns indicate that interference had existed during normal operation between the cams and the pins over an extended period of time. All eight pins also had roughened areas from approximately the 6:15 position to the 7:30 position (clock references are as looking forward, 9:00 being directly inboard). The 7:30 position corresponds closely to the area where the lower surface of the cam first contacts the pin as the door reaches the nearly closed position, before the cams are rotated to the latched position.

The hoop stresses generated by pressurization of the airplane create a bearing load against the cam/pin contacting points. Even if the cams are in the unlatched position, and the airplane is pressurized, this bearing load could act as a frictional latch between the cams and the pins and would tend to keep the door in the closed position.

 Transferred cam material and heat tinting of the pin surface was found to extend from the point where the cam-to-pin interface at the near fully open position of the latch cams (7:30 position) to a position corresponding to the bottom of the pin (6:15 position). This evidence was found on the roughened areas on all of the pins. The heat tinting and metal transfer are indicative of the high stress and rapid movement of the cam across the pin when the door separation occurred. Therefore, the location of this evidence indicates the probable location of the cams just before, and at the time of, separation of the door. The Safety Board concludes that these markings and their location on the pins resulted from a very fast, high bearing stress, separation of the cams across the pins, when the cams were in or very close to the unlatched position.

The pull-in hooks and pull-in hook pins would also counteract the pressurization loads in the outward direction, providing that the latch cams were not engaged on the latch pins and carrying the pressurization loads. However, Boeing studies showed that the pull-in hooks would fail at a pressure differential of about 3.5 psi, assuming that the cams are in the unlatched position and that there is no bearing load on the pins. Therefore, based on the probable pressure differential of about 6.5 psi just before the door separated, it is concluded that forces other than the pull-in hooks/pins were holding the door closed. Since the flightcrew and passengers reported no pressurization difficulties until the explosive decompression, it is reasonable to conclude that the door was being held closed by the bearing stresses of the cam-to-pin interfaces; not by the pull-in hooks alone.

The Safety Board believes that the approximate 1.5 to 2.0 seconds between the first sound (a thump) and the second very loud noise recorded on the CVR at the time of the door separation was probably the time difference between the initial failure of the latches at the bottom of the door, and the subsequent separation of the door, explosive decompression, and destruction of the cabin floor and fuselage structure. The door did not fail and separate instantaneously; rather, it first opened at the bottom and then flew open violently. As the door separated, it tore away the hinge and surrounding structure as the pressure in the cabin forced the floor beams downward in the area of the door to equalize with the loss of pressure in the cargo compartment.

There are three possible theories to explain why the latch cams could have been in a partially latched condition during flight. It is possible that the cams could have been manually back-driven (about 95 turns) after the door had been secured. This condition is considered unlikely since the UAL ramp personnel involved with dispatching the flight stated that the door was operated electrically. There is also the possibility that the cams could have been electrically back-driven after the door was secured. Lastly, it is possible that the cams were in the open, or nearly open, position after the door was "closed," and they they remained in that condition until the door separated. This hypothesis presumes that the lock sectors had been previously damaged, so that they would not be restricted from movement by the unlatched cams. The door would then appear to be locked and the airplane would pressurize.

 2.4 Electrical Opening of the Door on the Ground or in Flight

It was determined in 1987, after the Pan Am incident, that the locking sectors for B-747's, including those installed on N4713U, could be overcome by the force of the latch cam actuator, electrically or mechanically. If the latch cam actuator had been energized for some reason with the originally designed unstrengthened sector plates, the latch actuator motor was capable of driving the latch cams open through properly positioned lock sectors, whether they were damaged or undamaged. Therefore, the locking sectors installed as original equipment for B-747's, and those installed on N4713U, would not perform the locking function as intended by the design. They would not "lock" the latches in place as implied by the name "lock sectors." However, for an electrical malfunction to have caused the latch cams to open, after the door was secured on flight 811, several conditions would have to have occurred that are considered "highly improbable" in any case, and very unlikely in the case of flight 811.

The investigation has shown that there are several separate conditions that must be met before the latch actuator will inadvertently electrically drive the latch cams to the unlatched position on the B-747 after the door has been properly closed and locked. First, the ground handling power bus must be energized by having external power connected, or the APU must be operating and the APU generator field switch in the cockpit must be set to power the bus via the No. 2 ground handling power relay. Second, the air/ground relay must be in the "airplane on the ground" position. Third, there must be a signal (switch actuation by someone, or a short) to the door open position in one of the two door open/close switches. Fourth, the master latch lock switch, which cuts off power to the door actuators when the handle is stowed, must sense "open," or it must malfunction and not sense the handle closed. Therefore, it would take several independent conditions and some failures to provide for electrical power to be available to drive the door open electrically once it is closed and locked. The Safety Board found that three of these conditions did not exist after N4713U was in flight; however, two of those three conditions did exist during taxi and takeoff roll. Whether the fourth condition existed could not be determined conclusively, because the master latch lock switch was lost with the cargo door.

While the airplane was on the ground after engine startup, and with the cargo door master latch lock handle stowed and the APU running, an "open" signal to the door latch actuator would have occurred has the following conditions been met: (1) an energized ground handling bus resulting from the flightcrew re-energizing the APU generator field; (2) a malfunction of the master latch lock switch; (3) a malfunction of either of the door open/close switches; or (4) the placement of the switch in the "open" position by a person. There was no evidence that any of these events occurred. In addition, had an electrical short occurred in the door open switch or had the switch inadvertently been activated, these events would have had to persist for the precise time necessary to rotate the cams to the open position: a shorter time would not have opened the cams fully, and a longer time would have caused the pull-in hooks to rotate open. Open hooks  would have prevented the airplane from pressurizing after takeoff. The Safety Board believes that the occurrence of either event for such a precise time is highly improbable.

The Safety Board was able to examine two of the electrical relays and the door open/close switches from N4713U that would have to have failed to allow electrical operation of the cargo door in flight, with the APU running. These were the No. 2 ground handling power relay, the air/ground relay, and the internal and external door open/close switches. The examination of the relays and switches revealed no evidence of a single fault or conditions that might have caused an intermittent failure mode. The arcing noted on the No. 5 terminal of the outside door control switch was on the door "close" circuit and could not have been related to a short to the open mode. Further, because the flightcrew did not note a cargo door warning light, and the fact that the airplane was able to be pressurized, confirms that the master latch lock handle was in the closed position before takeoff. This position would actuate the master latch lock switch to disconnect power to the door opening actuators. However, since the door has not been recovered, the master latch lock switch could not be examined.

After takeoff, the air/ground relay, the No. 2 ground handling bus relay, the master latch lock handle switch, and one of the cargo door open/close switches would have to have malfunctioned. As discussed previously, the two relays and the door open/close switches were found functional. Although the flightcrew could conceivably energize the ground handling bus from the APU by actuating the APU generator "field" switch, there was no evidence that they did so. Even if they did, the air/ground relay, one of the cargo door open/close switches, and the master latch lock handle would have to have malfunctioned. There is no evidence that this occurred.

According to the flightcrew testimony and the pilots' comments recorded on the CVR during the flight, the APU was shutdown shortly after takeoff and remained in that condition. Engine generators can not power the ground handling bus from which the cargo door actuating mechanisms are powered. Once the APU was shutdown, there was no power available to any of the cargo door electrical components. Therefore, an actuation of the latch cam actuator at the time of the door loss was not possible.

The Safety Board believes that there is another reason why the opening of the door could not have been caused by electrical actuation shortly before the explosive decompression. Because the door carries the structural loads (hoop stresses) through its hinge and latches, the latch cams would be heavily loaded against the latch pins when the airplane was pressurized to the 6.5 psi differential pressure that was calculated to have been present at the time of the decompression. In that case, the torque-limiter within the actuator would probably slip well before the actuator could achieve the torque necessary to drive the cams open against the frictional lock produced by the high bearing stresses resulting from pressurization.

 In conclusion, the Safety Board believes that the cause of the loss of the door was not from an electrical actuation. However, because the door has not been recovered, it is not possible to rule out totally an unknown electrical malfunction that led to the movement of the latch cams during taxi or takeoff roll, and that friction loads were sufficient to prevent opening, until they were overcome by cabin pressurization loads. While the Safety Board does not believe that an electrical malfunction caused the door to become unlatched on flight 811, numerous electrical malfunctions that occurred during the ground handling of the forward cargo door in the months before the accident may have contributed to the events that led to the loss of the door. Those aspects will be discussed later.

2.5 Incomplete Latching of the Door During Closure

Another reason for an incomplete latching of the door during closure would be that the latch actuator was not able to rotate the cams to the closed position because of excessive binding forces between the latch cams and pins. This could occur if the cargo door was misaligned (out of rig) or if the pull-in hooks were not pulling the door in far enough to properly engage the cams around the pins. There is sufficient evidence of wear on the pins and from the previous discrepancies with the door to indicate that the door was misaligned and not properly rigged.

The smooth wear areas found on the pins from N4713U are signs of heavy contact (interference) between the cams and pins during numerous past closing and opening of the door. This wear, other evidence from the door, and the maintenance history of the door, suggest strongly that the door was out of rig during the weeks and months before the accident.

The wear pattern damage to the pull-in hook pins also showed interference during the normal ground operations prior to the accident. This is further evidence of an out-of-rig door.

It is also possible that the excessive binding force acting over a period of time may have precipitated a failure of the latch actuator. Regardless of the reason(s), the conditions of the latch pins and pull-in hook pins showed prolonged out-of-rig operation.

Most of the previous discrepancies with the forward cargo door on N4713U during December 1988 involved problems with closing the door electrically. These problems always occurred when the airplane was fully or nearly fully loaded, just before departure. The trouble-shooting and corrective actions by UAL maintenance, which on some occasions only involved cycling the door and finding it functional, were performed when the airplane was not fully loaded, during overnight maintenance inspections. It is possible that the flexing of the fuselage with a full load of fuel, cargo, and passengers caused distortion of the door frame and resulted in misalignment between the cams and pins. In this case, the pull-in hooks may not have pulled the door fully in before the cam actuator attempted to latch the door. The wear evidence on the latch pins from N4713U demonstrate that this event had been occurring before the accident.

 Safety Board investigators also witnessed this event during inspection and operation of the aft door on another UAL B-747, N4718U, in HNL. It was noted that the door on N4718U was not being pulled in fully by the pull-in hooks, so the latch cams completed the closing cycle with significant interference and "thunking" sounds. In fact, the out-of-rig door on N4718U failed to operate electrically at one point during its examination.

The ramp service personnel assigned to close the UAL B-747 cargo doors on flight 811 before departure would assume that the door closing action was completed when they observed the door move to the flush position, and when they heard the actuator stop running. Therefore, it is possible that the out-of-rig door on N4713U appeared to close and latch properly and the ramp agent then closed the master latch lock handle.

By design, any attempt to close the master latch lock handle and move undamaged lock sectors into place would not be successful unless the cams were fully rotated to the latched position. This condition was substantiated by Boeing tests. Even with severely damaged lock sectors, as found on the Pan Am B-747, if the cams were more than 20 turns from the fully closed position on the Pan Am airplane, the master latch lock handle could not be stowed.

Extensive damage to the sectors could occur in many ways and still permit movement of the master latch lock handle. For example, a person attempting to open the door manually could forget to unlock the master latch lock handle and begin to turn the cam actuator to the open position. The mechanical advantage of the socket wrench could then drive the cams open, even with the lock sectors in the locked position. This action would induce bending and gouging of the lock sectors or even break them off. Such damage could have occurred had the door been open with an air-driven screw driver (available at certain UAL bases) while the master latch lock handle was stowed.

Similarly, if the master latch lock switch had failed, and ground personnel had actuated the door open switch with the master latch lock handle stowed, the cam electrical actuator could have driven the cams toward the open position, bending and gouging the lock sectors.

The circumstances of the 1987 Pan Am incident and testing conducted after that incident demonstrated that all of the above methods could have induced damage to the lock sectors. Despite the absence of the actual hardware from N4713U, the Safety Board believes that the existing evidence strongly indicates that (1) the lock sectors on the forward cargo door had preexisting damage, and (2) the door out-of-rig sufficiently to allow the door to latch improperly yet be closed and indicate to ground personnel and the flightcrew that the door was properly latched and locked before takeoff.

It is probable that the lock sectors on the forward cargo door of the accident aircraft had been damaged previously when the latch cams were moved without first unlocking the sectors. The lock sectors were thus damaged (bent or broken) so that subsequently they would not restrict  the movement of the master latch lock handle to the stowed position, even when the latch cams were not fully latched. Under such conditions, the pressure relief doors would be closed and the cockpit warning light would be extinguished.

Figure 8 shows the cams in the fully latched and fully unlatched positions, respectively, and the probable position and damaged condition of the cams at the time of the door separation.

UAL had not incorporated the required inspection of the door closing and locking mechanisms following manual operation of the door and subsequent restoration to electrical operation (AD-88-12-04). Thus, any damage to the lock sectors caused during an improperly sequenced manual opening operation would have gone undetected. It is certainly possible that damage was induced to the lock sectors on N4713U during the months before the accident, when the airplane encountered repeated electrical malfunctions and manual operation of the forward cargo door. Further, the routine scheduled inspections performed on N4713U during the past 15 months did not include work items for an inspection of the lock sectors. The "A" and "B" checks did not require an inspection of the lock sectors. Therefore, the last time that the lock sectors for the forward cargo door of N4713U would have been inspected was during November 1988, at the scheduled "C" check. Further, no records of a rigging check of the door could be established back to the last "D" check in April 1984.

Consequently, the Safety Board concludes that the lock sectors on the forward cargo door of N4713U had been damaged during repeated manual operations, and the damage allowed the master latch lock handle to be stowed by the ramp service agent. This condition would provide a door closed/locked indication to the ramp agents and maintenance personnel, and to the flightcrew of flight 811, while the cams were in the unlatched, or nearly unlatched position. However, because the door has not been recovered and examined, the possibility of some unknown event cannot be ruled out.

The Safety Board also considered the possibility that the master latch lock handle had not been closed before the airplane departed the gate, and the possibility that the shrouds recommended by SB-747-52-2097 for the cargo door pressure relief doors were not installed on the forward door. If this were the case, it is possible that this condition allowed the pressure relief doors to be rotated closed when the airplane pressurized.

The Safety Board believes that these events were very unlikely based on the statements of the ramp personnel, line maintenance personnel, and the flightcrew. The ramp and maintenance personnel would have to have missed seeing the master latch lock handle in the unstowed position and the pressure relief doors open before departure. And, the flightcrew would have to have missed seeing the cockpit cargo door warning light indication.

It could not be determined whether the pressure relief door shrouds were actually installed on the forward door, although UAL records showed that they had been installed on both cargo doors of N4713U, in accordance with

 Figure 8.--Relative positions of latch cam, latch pin, and lock sector in properly latched and unlatched, and in improperly locked position.

 SB-747-52-2097. However, the shrouds were found not to be installed on the aft door, contrary to UAL records, and therefore may not have been installed on the forward door. If this were the case, the pressure relief doors could possibly have rotated shut during the pressurization cycle. However, since the closure of the pressure relief doors would back-drive the lock sectors, this scenario would presume previous damage to the sectors, which would permit the sectors to move over the unlatched cams. Although the Safety Board has concluded that the sectors had sustained previous damage, the Safety Board does not believe that the door was inadvertently left unlocked before departure.

The Safety Board's analysis of this accident went beyond the conclusions about how the door failed. The Safety Board also examined the initial design and certification of the B-747 cargo door, and the continuing airworthiness system that should have prevented this accident, to determine the break-downs in this system that led to the accident. As is the case with most aviation accidents, there are many factors that led up to the actual failure of the door on flight 811.

2.6 Design, Certification, and Continuing Airworthiness Issues

The Safety Board found that there were multiple opportunities during the design, certification, operation, and maintenance of the forward cargo door for the N4713U for persons to have taken actions that could have precluded the accident involving flight 811. The circumstances that led to this accident exemplify the need for human factors considerations in the promulgation of regulations, the application of regulatory policies, the design of airplane systems, and the quality of airline operational and maintenance practices.

The first opportunity to prevent this accident occurred during the design and certification of the B-747 cargo door mechanical systems, when the design was chosen and approved, which allowed for the overriding of the lock sectors by either mechanical or electrical actuation. It is apparent that the original design was not tested sufficiently to verify that the locking sectors in fact "locked" the latch cams in the closed position. This shortcoming should have become apparent during the initial certification testing and approval process. Later, it should have become apparent when Boeing applied for, and the FAA granted, an alternative method of compliance with the certification regulations (25.783 [e]) that permitted the elimination of operational practices that included a visual verification of the cargo door latch positions via view ports in the doors.

The failure mode analysis performed by Boeing, and the FAA's acceptance of its content in granting the exemption, probably were based on the assumption that the lock sectors would always prevent the master latch lock handle from being in a stowed position when the latch cams were not fully closed. This assumption was not valid, as evidenced by the findings in 1987 following the Pan Am incident that the lock sectors could not prevent the latch cams from being driven from the fully latched position with the master latch lock handle stowed, while a false  indication was provided to the flightcrew that the cargo door was properly latched and locked. At the time that Boeing sought approval of the alternative design, Boeing and the FAA should have reviewed the design and required testing of the door latch/lock mechanisms to verify their integrity. Because this verification was not made, the procedure for direct viewing of the latches via the view ports before the airplane could be dispatched was eliminated as a procedure.

The next opportunity for the FAA and Boeing to have reexamined the original assumptions and conclusions about the B-747 cargo door design and certification was after the findings of the Turkish Airline DC-10 accident in 1974 near Paris, France. The concerns for the DC-10 cargo door latch/lock mechanisms and the human and mechanical failures, singularly and in combination, that led to that accident, should have prompted a review of the B-747 cargo door continuing airworthiness. In the Turkish Airlines case, a single failure by a ramp service agent, who closed the door, in combination with a poorly designed latch/lock system, led to a catastrophic accident. The revisions to the DC-10 cargo door mechanisms mandated after that accident apparently were not examined and carried over to the design of the B-747 cargo doors.

Specifically, the mechanical retrofit of more positive locking mechanisms on the DC-10 cargo door to preclude an erroneous locked indication to the flightcrew, and the incorporation of redundant sensors to show the position of the latches/locks, were not required to be retrofitted at that time for the B-747. Of similar concern is the fact that the cargo doors for the L-1011 required redundant latch/lock indication sensors at initial certification, during the approximate same time frame the DC-10 and B-747 were certificated.

More recently, when Boeing and the FAA learned about the circumstances of the Pan Am cargo door opening incident in March 1987, more timely and positive corrective actions should have been taken. The Safety Board believes that the findings of that incident investigation should have called into question the assumptions and conclusions about the original design and certification of the B-747 cargo door, especially the alternative method for verifying that the door was latched and locked that was sought by Boeing and was granted by the FAA. Since a B-747 cargo door opening in flight was considered to be an "unacceptable event", once a door did come open in flight, the FAA and Boeing should have acted much quicker to prevent another failure.

It took nearly 16 months from the date of the Pan Am Incident (March 10, 1987) until the FAA issued AD-88-12-04 (July 1, 1988). And then, the AD allowed 18 or 24 months, depending on the model B-747, from the date of its issuance for compliance with the terminating actions of the AD. The fact that Boeing had issued an Alert SB as a result of the Pan Am incident is an indication of the apparent urgency with which Boeing treated this issue. Alert SB's are issued for "safety of flight" reasons, while regular SB's deal with "reliability" and not necessarily safety of flight items. Despite this, the terminating action, issued as revision 3 to the Alert SB, on August 27, 1987, was not mandated by the FAA for 11 months.

 The Safety Board found no evidence that the FAA or Boeing reassessed the original design and certification conclusions regarding the safety of the B-747 cargo door during this period. In fact, the original provisions for a visual verification of the latch cam position by use of the view ports were not re-instituted during this period.

Several opportunities for preventive action were also missed by UAL during this period. First, UAL delayed the completion of the terminating actions of Alert SB 52A2206 (Rev 3) and AD-88-12-04. In fact, there was no evidence that UAL had intended to comply with the terminating action of the Alert SB, until it was mandated by the FAA.

It is understandable that an airline would not take its aircraft out of service to incorporate revisions that do not appear to be safety critical. Although by definition an Alert SB is safety related, there was no implication from Boeing's and FAA's actions regarding this matter that urgency was required. The airlines rely on the airframe manufacturers and the FAA to evaluate the need for urgent airworthiness actions that might take airplanes out of revenue service. In this case, UAL had scheduled completion of its B-747 fleet modifications in accordance with the terminating actions for AD-88-12-04 before the final allowable date; however, the schedule was based on other heavy maintenance schedules to prevent unnecessary down-time of its airplanes.

UAL personnel stated after the UAL 811 accident that its personnel did not fully appreciate the importance, or safety implications, of the terminating actions, or they would have incorporated the improvements much earlier. The usual difficulties in setting short suspense dates for performing terminating actions in AD's, such as parts availability, did not seem to exist in this case, because the parts were not complex components and probably could have been fabricated fairly quickly in-house by most airlines.

Human performance certainly contributed to UAL's failure to incorporate an important inspection step into its maintenance program as mandated by AD-88-12-04. When UAL obtained an advance draft copy of the forthcoming NPRM that eventually led to the AD, the airline began preparing its work orders to implement the forthcoming the AD requirements into its B-747 fleet (30 airplanes at the time). UAL developed its maintenance work sheets from the text of the draft NPRM, which was virtually identical to the text of the final rule. As a result of a clerical error, one of the important inspection steps  required by the AD was omitted.

Apparently, UAL maintenance personnel never compared the work sheets they received with the actual requirements of the AD, or if they did, the omission was not detected. FAA inspectors responsible for oversight of UAL's maintenance program also did not detect this error. In fact, FAA's inspection and surveillance did not enable the FAA inspectors to detect the error, because their surveillance of AD compliance merely involved verifying the correctness of UAL's paperwork that listed the applicable AD's and compliance dates. The inspectors did not actually verify UAL's compliance action by shop visits, or by comparison of work sheets with AD  provisions. These omissions by the UAL maintenance and quality assurance personnel, and the limitations of the FAA surveillance procedures were probably significant in setting the stage for the events that led to the actual cause of the door separation from N4713U.

The fact that the forward cargo door on N4713U had experienced intermittent and repeated malfunctions in its normal (electrical) operation during the month of December, 1988, and the fact that UAL had inadvertently left out of its procedures an inspection of the lock sectors after each subsequent manual operation and return to normal operation, prevented detection of damaged lock sectors on the cargo door.

Another matter of concern is the quality of UAL's trend analysis program. There was no indication that the repeated discrepancies with the forward cargo door on N4713U "raised a flag" within the UAL maintenance department. A quality assurance or trend analysis program should have detected an adverse trend and should have prompted efforts to resolve the repeated problems (possibly an intermittent shorting of the door closing switch or the out of rig condition). If it had, the damage to the lock sectors would have been detected.

In summary, the Safety Board concludes that there were several opportunities wherein Boeing, the FAA, and UAL could have taken action during the initial design and certification of the B-747 cargo door, as well as during the operation and maintenance of the cargo door installed on N4713U, to ensure the continuing airworthiness of the cargo door. The Safety Board further concludes that these deficiencies and oversights contributed to the cause of this accident.

2.7 Survival Aspects

The Hickham ARFF units and the airport's ARFF units operated on separate radio networks and thus they could not communicate directly on-scene by radio. This situation required them to communicate by voice. Although the two ARFF services had a common radio frequency (as per the Airport Emergency Plan), procedures for its use had not yet been developed. The Safety Board believes that such communication procedures should be expeditiously developed.

The use of camouflage paint schemes on military ARFF vehicles may be appropriate for military purposes; however, the Safety Board believes that camouflage is not appropriate for ARFF vehicles that are operated at a joint-use airport. It is obvious that these vehicles must be conspicuous to be seen by other responding vehicles and by persons who are involved in the accident, such as airport and airline personnel, crew and passengers, and off-airport firefighting and rescue vehicles.

The National Fire Protection Association Standards recommend for primary firefighting, rapid intervention and combined agent vehicles, that, "Paint finish shall be selected for  maximum visibility and shall be resistant to damage from firefighting agents."4 Furthermore, Federal Aviation Regulation 14CRF 139.319 (f) (2) requires emergency vehicles, "Be painted or marked in colors to enhance contrast with the background environment and optimize daytime and nighttime visibility and identification." Further guidance for the high visibility color of ARFF vehicles is provided in a Federal Aviation Administration Advisory Circular where the vehicle paint color is specified as, "lime yellow" Dupont No. 7744 UH or its equivalent.5

Because flight attendants are vital to the safety and survival of the passengers following a decompression, measures should be taken to prevent flight attendants from being incapacitated by hypoxia. The Safety Board believes that oxygen masks should be attached to the emergency oxygen bottles to avoid any delay in their use in order to be in compliance with the intent of 14 CFR 25.1447 (c)(4). Therefore, the FAA should direct its inspector staff to survey B-747 airplanes for compliance with 14 CFR 25.1447(c)(4), and correct deficiencies found.

In this accident, the use of megaphones was vital because of the inability to be heard over the public address (PA) system. Title 14 CFR 121.309 (f)(1) requires one megaphone on each airplane with a seating capacity of more that 60 and less that 100 passengers; 14 CFR 121.309 (f)(2) requires two megaphones in the cabins on each airplane with a seating capacity of more than 99 passengers. As this decompression demonstrated, additional megaphones are necessary on wide-body and large narrow-body airplanes to ensure communication in the cabin during emergencies when the PA system is inoperative.

Had there been a need for an immediate evacuation, or a water ditching, rapid egress would not have been possible at doors 2-left and 2-right because they were blocked by open storage compartments and spilled contents. The possibility also exists that a compartment door could release during a hard landing or turbulence and swing down and injure a flight attendant. Thus, the Safety Board believes that improved latches should be installed and the downward movement of stowage compartments doors should be restricted to prevent the doors from striking a seated flight attendant or block the exit door.

The Safety Board believes that the problems with life preserver donning and adjustment demonstrated in this accident should be addressed by the FAA. The straps and fittings on life preservers need to be evaluated to determine where improvements can be made, and clearer  donning instructions should be developed. TSO-C13d, Life Preservers 1/3/83 prescribes the minimum performance standards for life preservers. With regard to donning, the TSO requires:

"Donning. It must be demonstrated that an adult, after receiving only the customary preflight briefing on the use of life preservers, can don the life preserver within 15 seconds unassisted while seated. It must be demonstrated that an adult can install the life preserver on another adult, a child, or an infant within 30 seconds unassisted. The donning demonstration is begun with the unpackaged life preserver in hand."

Based on flight attendant interviews and information obtained from passengers these donning times were exceeded in many instances.

The Safety Board has made numerous recommendations to the FAA in the past regarding needed improvements in life preserver donning instructions, donning procedures, and timing of donning.6 The FAA has adopted most of the Safety Board's recommendations in its April 23, 1986, revision to TSO-C13e, Life Preservers, which now requires the wearer to be able to secure the preserver with no more than one attachment and make no more than one adjustment for fit. Also, donning tests are required for age groups of users starting with 20-29 years and ending with 60-69 years. At least 60% of the test subjects in each age group must be able to don then life preserver within 25 seconds unassisted with their seatbelts fastened starting with the life preserver in its storage package. TSO-C13e contains requirements that would have eliminated some of the problems that passengers had in this accident in correctly donning and adjusting their life preservers.

The Safety Board has recommended (A-85-35 through-37) to the FAA to amend 14 CFR 121, 125, and 135 to require air carriers to install life preservers that meet TSO-C13e within a reasonable time. The FAA adopted TSO-C13e on April 23, 1986, and originally had specified an effective date of April 23, 1988, after which all newly manufactured life preservers approved under the TSO system would have to meet the requirements of TSO-C13e. The objective of the cut off date was to introduce life preservers into the fleets with the higher performance level as specified in TSO-C13e by assuring that replacement articles met the higher standards. On March 3, 1988, the FAA rescinded the cut off date to seek further public comments of fleet retrofit in accord with the proposed rulemaking. See Section 4.0 for FAA action and status of the recommendations.

 3. CONCLUSIONS

3.1 Findings

1. There were no flightcrew or cabin crew factors in the cause of the accident or injuries.

2. There were no air traffic control or weather factors in the cause of the accident.

3. The airplane had not been maintained in accordance with the provisions of AD-88-12-04, which required an inspection of the cargo door locking mechanisms after each time the door was operated manually and restored to electrical operation.

4. All but one of the electrical components required to have malfunctioned in order to cause an inadvertent electrical opening of the cargo door after dispatch were found to function properly. One was lost with the door.

5. The multiple intermittent malfunctions of the forward cargo door for N4713U during the months prior to the accident led to damaged lock sectors.

6. UAL maintenance trend analysis program was inadequate to detect an adverse trend involving the cargo door on N4713U.

7. FAA oversight of the UAL maintenance and inspection program did not ensure adequate trend analysis and adherence to the provisions of airworthiness directives.

8. The smooth wear patterns on the latch pins of the forward cargo door installed on N4713U were signs that the door was not properly aligned (out of rig) for an extended period of time, causing significant interference during the normal open/close cycle.

9. The rough heat-tinted wear areas on the latch pins of the forward cargo door installed on N4713U marked the positions of the cams at the time the door opened in flight.

10. The design of the B-747 cargo door locking mechanisms did not provide for the intended "fail-safe" provisions of the locking and indicating systems for the door.

11. Boeing's Failure Analyis, which was the basis upon which the FAA granted an alternative method of compliance with the provisions of 14 CFR 25.783 (e), was not valid as evidenced by the findings of the Pan Am incident in 1987.

 12. Boeing and the FAA did not take immediate action to require the use of the cam position view ports following the Pan Am incident, and did not include this requirement in the provisions of the Alert Service Bulletins or AD-88-12-04.

13. There were several opportunities for the manufacturer, the airline, and the FAA, to have taken action during the service life of the Boeing 747 that would have prevented this accident.

14. The fact that the crash fire rescue vehicles responding to this accident did not use a common radio frequency led to problems in communication among the responding vehicles.

15. The camouflage paint scheme of the military fire rescue units led to reduced visibility of these units and resulted in at least one near-collision.

16. Megaphones were used in flight to communicate with passengers because of the high ambient noise level. However more megaphones would have afforded better communications in all parts of the cabin.

17. Some flight attendants and passengers had difficulties tightening straps of their life preservers around their waists because of the fabric used, the design of the adjustment fittings, and the angle the straps were pulled.

3.2 Probable Cause

The National Transportation Safety Board determines that the probable cause of this accident was the sudden opening of the improperly latched forward lower lobe cargo door in flight and the subsequent explosive decompression. Contributing to the cause of the accident was a deficiency in the design of the cargo door locking mechanisms, which made them susceptible to inservice damage, and which allowed the door to be unlatched, yet to show a properly latched and locked position. Also contributing to the accident was the lack of proper maintenance and inspection of the cargo door by United Airlines, and a lack of timely corrective actions by Boeing and the FAA following the 1987 cargo door opening incident on a Pan Am B-747.

 4. RECOMMENDATIONS

As a result of this investigation, on August 23, 1989, the Safety Board issued the following safety recommendations for the FAA to:

Issue an Airworthiness Directive (AD) to require that the manual drive units and electrical actuators for Boeing 747 cargo doors have torque limiting devices to ensure that the lock sectors, modified per AD-88-12-04, cannot be overridden during mechanical or electrical operation of the latch cams. (Class II, Priority Action) (A-89-92)

Issue an Airworthiness Directive (AD) for non-plug cargo doors on all transport category airplanes requiring the installation of positive indicators to ground personnel and flightcrews confirming the actual position of both the latch cams and locks, independently. (Class II, Priority Action) (A-89-93)

Require that fail-safe design considerations for non-plug cargo doors on present and future transport category airplanes account for conceivable human errors in addition to electrical and mechanical malfunctions. (Class II, Priority Action) (A-89-94)

The Federal Aviation Administration (FAA) responded to Safety Recommendations A-89-92 through -94 on November 3, 1989. During its evaluation of Safety Recommendation A-89-92, the FAA determined that Boeing 747 cargo doors with lock sectors, modified in compliance with Airworthiness Directive (AD) 88-12-04, cannot be overridden during mechanical or electrical operation of the latch cams because the latch cam actuators incorporate at least one torque-limiting device. The Safety Board has reviewed AD 88-12-04 and has confirmed the FAA's findings. Based on this, Safety Recommendation A-89-92 has been classified as "Closed--Reconsidered."

The FAA responded to Safety Recommendations A-89-93 and -94 describing action to review all outward opening (nonplug) doors and all jetpowered transport category airplanes to determine what, if any, modifications are needed to ensure that these doors will not open in flight. The FAA pointed out that the door latch indicating system is to be only part of the review and that door designs will be evaluated against criteria specified in 14 CFR 25.783 as amended by Amendment 25-54, and the policy material published in Advisory Circular 25.783.1, adopted in 1980 and will take into account human factors involved in the routine operation of closing and locking doors to ensure that the latch and lock systems are fail-safe. Further, to emphasize the importance of human factors, the FAA has developed a training program for FAA certification personnel to enhance their knowledge of human factors in aircraft design. This training program will be offered to approximately 100 certification personnel during the next year. Based on this response, Safety Recommendations A-89-93 and -94 have been classified as "Open--Acceptable Action." The Safety Board believes it necessary to point out that this hazard exists for any  pressurized aircraft using non-plug doors and that the FAA should not be limiting this review to only those transports which are jet-powered.

Also, as a result of this accident, the National Transportation Safety Board recommends that the Federal Aviation Administration:

Amend 14 CFR 1447 (c)(4) to require that face masks be attached to the regulators of portable emergency oxygen bottles. (Class II, Priority Action) (A-90-54)

Require, in accordance with the requirements of 14 CFR 25. 1447 (c)(4), that a portable oxygen bottle be located at the flight attendant stations at exit door 5 right and at exit door 5 left in B-747 airplanes. (Class II, Priority Action) (A-90-55)

Require that no articles be placed in storage compartments that are located over emergency exit doors. (Class II, Priority Action) (A-90-56)

Amend 14 CFR 121.309 (f) to require a readily accessible megaphone at each seat row at which a flight attendant is stationed. (Class II, Priority Action) (A-90-57)

Take corrective action to improve direct visibility to passengers from the upper level flight attendant jumpseat in the B-747 airplanes using eye reference data contained in Federal Aviation Administration report FAA-AM-75-2 "Anthropometry of Airline Stewardesses." (Class II, Priority Action) (A-90-58)

Issue an Airworthiness Directive to require that stronger latches be installed in oversized storage compartments that formerly held liferafts on all B-747 airplanes and also limit the distance that these compartments can be opened. (Class II, Priority Action) (A-90-59)

Demonstrate for each make and model of life preserver that it can be donned, adjusted, and tightened within the elapsed time required by TSO-C13d. Direct particular attention to the ease with which straps pass through adjustment fittings when the straps are pulled at all possible angles. (Class II, Priority Action) (A-90-60)

Establish a cutoff date of [within 1 year of this recommendation letter] after which all life preservers manufactured for passenger-carrying aircraft would be required to meet the specifications of TSO-C13e. (Class II, Priority Action) (A-90-61)

 Also as a result of this accident, the National Transportation Safety Board reiterates the following recommendations to the Federal Aviation Administration:

A-85-35

Amend 14 CFR 121 to require that all passenger-carrying air carrier aircraft operating under this Part be equipped with approved life preservers meeting the requirements of the most current revision of TSO-C13 within a reasonable time after the adoption of the current revision of the TSO; ensure that 14 CFR 25 is consistent with the amendments to Part 121. (Class II, Priority Action)

A-85-36

Amend 14 CFR 125 to require that all passenger-carrying air carrier aircraft operating under this Part be equipped with approved life preservers meeting the requirements of the most current revision of TSO-C13 within a reasonable time after the adoption of the current revision of the TSO; amend Part 125 to require approved flotation-type seat cushions (TSO-C72) on all such aircraft; ensure that 14 CFR 25 is consistent with the amendments of Part 125. (Class II, Priority Action)

A-85-37

Amend 14 CFR 135 to require that all passenger-carrying air carrier aircraft operating under this Part be equipped with approved life preservers meeting the requirements of the most current revision of TSO-C13 within a reasonable time after the adoption of the current revision of the TSO; Amend Part 135 to require approved floatation-type seat cushions (TSO-C72) on all such aircraft; ensure that 14 CFR SFAR No. 23 is consistent with the amendments to Part 135. (Class II, Priority Action)

In a November 28, 1988, letter to the FAA the Safety Board recommended that a cut off date January 1, 1989, be reestablished. Based on this accident, the Safety Board's again urges the FAA to establish a cut off date by which life preservers meeting TSO-C13e would be introduced into the fleets within a reasonable time (A-85-36). The Safety Board recognizes that the FAA has complied with part of this recommendation, pertaining to the floatation-type seat cushions.

Safety Recommendations A-85-35 and -37 are being held in an "Open--Acceptable Action" status pending the publication of the final rule. Safety Recommendation A-85-36 is being held in an "Open--Unacceptable Action" status because Part 125 operations were not included in the FAA rulemaking action.

 As a result of its investigation, the National Transportation Safety Board also recommends that the State of Hawaii, Department of Transportation, Airports Division:

Develop, in cooperation with the Department of Defense, procedures for direct radio communication between aircraft rescue and fire fighting vehicles operated by the State of Hawaii and Hickam Air Force Base that would be used when responding to airport emergencies at Honolulu International Airport. (Class II, Priority Action) (A-90-62)

Additionally, as a result of its investigation, the National Transportation Safety Board recommends that the Department of Defense:

Develop in cooperation with the State of Hawaii Department of Transportation, procedures for direct radio communication between aircraft rescue and firefighting vehicles operated by Hickam Air Force Base and the State of Hawaii that would be used when responding to airport emergencies at Honolulu International Airport. (Class II, Priority Action) (A-90-63)

Comply with Federal regulation 14 CFR 139.319(f)(2) and the guidance contained in Federal Aviation Administration Advisory Circular 150/5220-14 by using high visibility color for aircraft rescue and firefighting vehicles that operate at Honolulu International Airport. (Class II, Priority Action) (A-90-64)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

/s/ James L. Kolstad Chairman

/s/ Susan Coughlin Acting Vice Chairman

/s/ John K. Lauber Member

/s/ Jim Burnett Member

April 16, 1990

 5. APPENDIXES

APPENDIX A

INVESTIGATION AND HEARING

1. Investigation

The Washington Headquarters of the National Transportation Safety Board was notified of the United Airlines accident within a short time after the occurrence. A full investigation team departed Washington, D.C. at 1400 eastern daylight time on the same day and arrived in Honolulu at 0030 Hawaiian standard time the next day.

The team was composed of the following investigation groups: Operations, Structures/Systems, Maintenance Records, Metallurgy, and Survival Factors. In addition, specialist reports were prepared relevant to the CVR, FDR and radar plots.

Parties to the field investigation were United Airlines, the FAA, the Boeing Commercial Airplane Company, the Air Line Pilots Association, the International Association of Machinists, and the Association of Flight Attendants.

2. Public Hearing

A 3-day public hearing was held in Seattle, Washington, beginning on April 25, 1989. Parties represented at the hearing were the FAA, United Airlines, the Boeing Commercial Airplanes Company, the Air Line Pilots Association, and the International Association of Machinists.

 APPENDIX B

PERSONNEL INFORMATION

Captain David Cronin

Captain David Cronin, 59, was hired by UAL on December 10, 1954. The captain holds Airline Transport Pilot (ATP) Certificate No. 1268493 with airplane multiengine land ratings and commercial privileges in airplane single-engine land, sea and gliders. The captain is type rated in the B747, DC10, DC8, B727, Convair (CV) 440, CV340, CV240 and the learjet. The captain was issued a first class medical certificate on November 1, 1988, with no limitations.

The captain's initial operating experience (IOE) check out in the B747 occurred in December, 1985. The captain's latest line and proficiency checks in the B747 were completed in August and December, 1988, respectively. Training in ditching and evacuation was included with the proficiency check. The captain had flown a total of about 28,000 hours, 1,600 to 1,700 hours of which were in the B747. During the 24-hour, 72-hour and 30-day periods, prior to the accident, the captain had flown: 1 hour, 5 minutes; 13 hours, 35 minutes; and 76 hours, 18 minutes, respectively.

First Officer Gregory Slader

First Officer Gregory Slader, 48, was hired by UAL on June 15, 1964. The first officer holds ATP Certificate No. 1528630 with airplane multiengine land ratings and commercial privileges in airplane single-engine land. The first officer is type rated in B747, DC10, B727, and B737. The first officer was issued a first class medical certificate on February 14, 1989, with no limitations.

The first officer's initial operating experience (IOE) check out in the B747 occurred in August, 1987. The first officer's latest proficiency check in the B747 was completed in October, 1988. Training on ditching and evacuation was included with the proficiency check. The first officer had flown a total of about 14,500 hours, 300 hours of which were in the B747. During the 24-hours, 72-hour and 30-day periods prior to the accident, the first officer had flown: 1 hour, 5 minutes; 13 hours, 35 minutes; and 46 hours, 25 minutes, respectively.

Second Officer Randal Thomas

Second Officer Randal Thomas, 46, was hired by UAL on May 22, 1969. The second officer holds Flight Engineer Certificate No. 1947041 for turbo jet powered airplanes, issued July 18, 1969. The second officer holds commercial pilot certificate No. 1585899 with ratings and limitations of airplane single and multiengine land with instrument privileges. The second officer was issued a first class medical certificate on December 6, 1988, with no limitations.

 The second officer's IOE check out in the B747 occurred in March, 1987. The second officer's latest proficiency check in the B747 was completed in October, 1988. Training in ditching and evacuation was included with the proficiency check. He had flown a total of about 20,000 hours, about 1,200 hours of which were as second officer on the B747. During his 24-hour, 72-hour and 30 day-periods, prior to the accident, the second officer had flown: 1 hour, 5 minutes; 13 hours, 35 minutes; and 46 hours, 25 minutes, respectively.

Flight Attendant and Chief Purser Laura Brentlinger

Flight attendant Laura Brentlinger, 38, was employed by UAL in April 1972; and had completed B747 recurrent training on September 19, 1988.

Flight Attendant and AFT Purser Sarah Shanahan

Flight attendant Sarah Shanahan, 42, was employed by UAL in August 1967; and had completed B747 recurrent training on October 10, 1988.

Flight Attendant Richard Lam

Flight attendant Richard Lam, 41, was employed by UAL on April 1970; and had completed B747 recurrent training on September 16, 1988.

Flight Attendant John Horita

Flight attendant John Horita, 44, was employed by UAL in June 1970; and had completed B747 recurrent training on November 1, 1988.

Flight Attendant Curtis Christensen

Flight attendant Curtis Christensen, 34, was initially employed by PAA in May 1978. He was subsequently employed by UAL in February 1986 when UAL purchased PAA Pacific Division. Flight attendant Chrisensen had completed B747 recurrent training on December 12, 1988.

Flight Attendant Tina Blundy

Flight attendant Tina Blundy, 36, was employed by UAL in May 1973; and had completed B747 recurrent training on October 28, 1988.

Flight Attendant Jean Nakayama

Flight attendant Jane Nakayama, 37, was employed by UAL in August 1973; and had completed B747 recurrent training on December 6, 1988.

Flight Attendant Mae Sapolu

Flight attendant Mae Sapolu, 38, was initially employed by Pan American Airlines (PAA) in March 1973. She was subsequently employed by UAL in February 1986; when UAL purchased PAA Pacific Division. Flight attendant Sapolu completed B747 recurrent training on October 13, 1988.

 Flight Attendant Robyn Nakamoto

Flight attendant Robyn Nakamoto, 26, was employed by UAL in April, 1986, and transferred to the Inflight Service Division in May, 1988. She was initially trained on the B747 in May 1988; and had not attended recurrent training.

Flight Attendant Edward Lythgoe

Flight attendant Edward Lythgoe, 37, was employed by UAL in December 1978; and had completed B747 recurrent training on October 21, 1988.

Flight Attendant Sharol Preston

Flight attendant Sharol Preston, 39, was employed by UAL in July 1970; and had completed B747 recurrent training on July 29, 1988.

Flight Attendant Ricky Umehira

Flight attendant Ricky Umehira, 35, was employed by UAL in November 1983; and had completed B747 recurrent training on November 15, 1988.

Flight Attendant Darrell Blankenship

Flight attendant Darrell Blankenship, 28, was employed by UAL in February 1984; and had completed B747 recurrent training on February 10, 1988.

Flight Attendant Linda Shirley

Flight attendant Linda Shirley, 30, was employed by UAL in March 1979; and had completed B747 recurrent training on November 3, 1989.

Flight Attendant Ilona Benoit

Flight attendant Ilona Benoit, 48, was initially employed by PAA in November 1969. She was subsequently employed by UAL in February 1986; and had completed B747 recurrent training on November 17, 1988.

Lead Ramp Serviceman Paul Engalla

Lead ramp serviceman Paul Engalla was employed by UAL in 1959. Because of his extensive ramp service experience, Mr. Engalla was selected as a ramp service trainer in 1986.

Ramp Serviceman Daniel Sato

Ramp serviceman Daniel Sato was employed by UAL in May 1987. Company records indicate that his proficiency in the opening and closing of B747 cargo doors and the operation of container loads was attained in September 1988.

 Ramp Serviceman Brian Kitaoka

Ramp serviceman Brian Kitaoka was employed by UAL in November 1986. Company records indicate that his proficiency in the operation of container loaders was attained in November 1987. His proficiency in the opening and closing of B747 cargo doors was attained in October 1988.

Dispatch Mechanic Steve Hajanos

Dispatch mechanic Steve Hajanos was employed as an airplane mechanic by UAL on October 30, 1986. He holds FAA Airplane and Powerplants Certificate No. 362583850, issued November 14, 1981. He was formerly employed by Aloha Airlines as a maintenance supervisor and by World Airways as a mechanic and maintenance supervisor. He began his aviation career as an airplane mechanic in the United States Air Force.

 APPENDIX C

AIRPLANE INFORMATION

Type of Date of Maximum Inspection Inspection Cycles Interval Service No. 1 Current 02/23/89 58,814 15,027 Note 1 Previous 02/23/89 58,809 15,026 Service No. 2 Current 02/22/89 58,802 15,024 65 Hours Previous 02/18/89 58,747 15,016 Note 2 A Check Current 02/14/89 58,710 15,009 350 Hours Previous 01/16/89 58,368 14,947 B Check Current 11/28/88 57,751 14,839 131 Days Previous 07/28/88 56,635 14,632 C Check Current 11/28/88 57,751 14,839 393 Days Previous 11/19/87 53,789 14,146 MPV Check Current 04/30/84 43,731 11,857 5 Years Previous 01/30/80 30,906 D Check Current 04/30/84 43,731 19,237 9 Years Previous 09/09/76 19,237 Note 1: Service No. 1 to be accomplished on through flights or at trip termination whenever time is less than 12 hours per Maintenance Manual Procedures BX 12-0-1-1.

Note 2: Aircraft with layover of 12 hours or more will receive a Service No. 2 not to exceed 65 flight hours between checks.

 APPENDIX D

Flight Crewmember.--The second officer sustained minor superficial brush burns to both elbows and forearms, during the evacuation.

Cabin Crewmembers.--The cabin crewmembers sustained the following injuries during the evacuation:

Flight attendant No. 1 sustained a strained left shoulder;

Flight attendant No. 2 sustained acute thoracic and lumbosacral strain;

Flight attendant No. 3 sustained a mild right bicep strain;

Flight attendant No. 4 sustained a left elbow contusion, left shoulder dislocation, and mild lumbosacral strain;

Flight attendant No. 5 sustained a left calf contusion;

Flight attendant No. 6 sustained a mild left elbow bruise;

Flight attendant No. 7 sustained mild left arm and lower back strain;

Flight attendant No. 8 sustained a soft tissue injury to the back;

Flight attendant No. 9 sustained abrasions to both palms and the left knee;

Flight attendant No. 10 sustained a fracture of the left tenth rib;

Flight attendant No. 11 sustained a minimal injury to the right middle finger PIP joint and left first MP joint;

Flight attendant No. 12 sustained a pulled muscle on the left side of the neck;

Flight attendant No. 13 sustained a comminuted fracture of the right ulna and radius;

Flight attendant No. 14 sustained a mild thoracic back strain;

Flight attendant No. 15 sustained a non-displaced fracture of C-6, a cerebral concussion, a fracture of the proximal right humerus, and multiple lacerations;

 A flight attendant, flying as a passenger, sustained mild lumbosacral strain, a laceration of the right little finger, and a left elbow abrasion.

Passengers.--Nine Passengers who were seated in seats 8H, 9FGH, 10GH, 11GH, and 12H, were ejected from the fuselage and were not found; and thus, are assumed to have been fatally injured in the accident.

Passengers seated in the indicated seats sustained the following injuries:

Seat

7C - Barotrauma to both ears

9C - Half-inch laceration to the upper left arm, superficial abrasions to left arm and hand, barotrauma to both ears

9E - Superficial abrasions and contusions to the left hand, mild barotrauma to both ears

10B - Superficial abrasions to the left elbow and left middle finger

10E - Superficial abrasions to the torso and left forearm, bruising of the left hand and fingers

11E - Laceration on the right ankle tendon, multiple bruises

11F - Slight contusion of the right shoulder

13D - Barotrauma to both ears

13E - Bleeding in both ears

13H - Contusion to the left periorbital area

14A - Laceration in the parietal occipital area, barotrauma to both ears

15J - Comminuted fracture of the lateral epicondyle of the left distal humerus (about 5mm separation)

16B - Superficial abrasions to the right arm

16J - Barotrauma to both ears

16K - Right temporal abrasions

 26A - Barotrauma to both ears

26B - barotrauma to both ears

26H - Barotitis to both ears, low back pain, irritation to the right eye due to foreign bodies

27A - Barotrauma to the right ear

28J - Superficial abrasions and a contusion to the left hand, mild barotrauma to both ears

 APPENDIX E

DETAILS OF LATCH PIN WEAR OBSERVED ON UAL B-747 N4718U

(PROBLEM ABBREVIATIONS EXPANDED)

STATION INBOUND FLT/DATE OUTBOUND FLT/DATE PROBLEM 830 12/5 825 12/5 Report - forward cargo door will not open. Corrective action: cranked door latches to close an recycled, checked okay. 824 12/6 812 12/7 Report - forward cargo door will not open electrically. Corrective action: cranked door latches to close and recycled. Checked okay. 812 12/7 811 12/7 No problem 811 12/7 811 12/7 No problem 811 12/7 811 12/7 No problem 811 12/7 812 12/9 No problem 812 12/9 812 12/9 No problem 812 12/9 812 12/9 No problem 812 12/9 811 12/9 No problem 811 12/9 811 12/9 No problem 811 12/9 811 12/9 No problem 811 12/9 812 12/11 No problem 812 12/11 812 12/11 Report - forward cargo door failed to close fully electrically, manually cranked "pull in" hooks half a turn to close and latches ran okay. Corrective action: adjusted on hook switches Deferred maintenance item 0827 initiated. 812 12/11 812 12/12 Report - door cycled 3 times, opened and closed normally. Corrective action: cleared deferred maintenance item 827 812 12/12 811 12/12 No problem 811 12/12 811 12/12 No problem 811 12/12 811 12/12 Report - forward cargo door fails to close electrically. Manually turned hooks to close with door switch selected close until power transferred to latch motor. Hook motor switch requires re-rigging. Corrective action: Deferred maintenance item 831 initiated. 

STATION INBOUND FLT/DATE OUTBOUND FLT/DATE PROBLEM 811 12/12 812 12/14 Report - forward cargo door will not latch electrically. When manually closing, latches fail to close sufficiently to close master latch lock after repeated attempts. Corrective action: latches opened manually, door recycled again and operation was normal electrically. (Deferred maintenance item 0831 continued open for future repair.) 812 12/14 812 12/14 Report - when the aircraft landed, the door operated like the deferred write up. The aft lower corner of the door appears to be trailing. Suspect the hook motor may be over-heating causing the problem. Note: adjusted S-8 door switch, the door operates okay. The adjustment stop for S-8 is bent. Corrective action: (Deferred maintenance item 0831 continued open for future repair.) 812 12/14 812 12/14 Manual operation 812 12/14 811 12/14 Manual operation 811 12/14 811 12/14 Manual operation HNL (layover) 811 12/14 (Ret blks) 825 12/16 Manual operation 825 12/16 824 12/17 Manual operation 824 12/17 831 12/17 Report - necessary to cycle door 3 times to get it to latch manually. Corrective action: deferred maintenance item 0831 continued open for future repair. 831 12/17 831 12/17 Manual operation HKG (layover) 831 12/17 830 12/19 Report - deferred maintenance item 0831. Corrective action: replaced hook position relay K1. Checked door several times. It checked okay. Deferred maintenance item 0831 corrected. 830 12/19 58 12/19 No problem #8413

FORWARD CARGO DOOR

HISTORY - 12/1/88 THROUGH 2/22/89

STATION INBOUND FLT/DATE OUTBOUND FLT/DATE PROBLEM 58 12/19 53 12/19 No problem 53 12/19 830 12/20 No problem 830 12/20 827 12/20 No problem 827 12/20 801 12/20 No problem TPE (layover) 801 12/20 800 12/22 No problem 800 12/22 150 12/22 Report - prior to departure, forward cargo door inoperative electrically. Manually closed. Corrective action: deferred maintenance item 0835 initiated for future repair. 150 12/22 150 12/22 Manual operation ORD (layover) 150 12/22 143 12/23 Report - deferred maintenance item 0835. Corrective action: operated door several times, could not duplicate. Checked hook closed switch & hook position switch for being closed per MM-52-34-60 procedure 13. Deferred maintenance item 0835 corrected. 143 12/23 143 12/23 No problem 143 12/23 150 12/24 No problem 150 12/24 150 12/24 No problem ORD (layover) 150 12/24 1 12/25 No problem HNL (layover) 1 12/25 812 12/25 No problem 812 12/26 811 12/26 No problem 811 12/26 811 12/26 No problem 811 12/26 811 12/26 No problem 811 12/26 812 12/28 No problem 812 12/28 812 12/28 No problem 812 12/28 812 12/28 No problem 812 12/28 811 12/28 No problem 811 12/28 811 12/28 No problem 811 12/28 811 12/28 No problem 811 12/28 812 12/30 No problem 812 12/30 812 12/30 No problem 

1 Leading edge flaps are numbered 1 to 26 from left wing outboard to right wing outboard and constitute a set of 5 variable camber flaps outboard of engines Nos. 1 and 4, a set of 5 variable camber flaps between the two engines on each wing; and a set of three Krueger flaps inboard of each inboard engine (Nos. 2 and 3 engines).

2 The flap track canoe fairings are numbered 1 through 8, from left outboard to right outboard.

3 The PMI does not formally approve the airline manual or changes, but the PMI has the responsibility to review the manual and promptly advise the operator when any portion is found unacceptable. (Reference, Airworthiness Inspectors Handbook, Department of Transportation, Federal Aviation Administration, order 8300.9 July 25, 1985, Chapter 6, Section 4, Maintenance Manual Requirements.)

4 NFPA 414 - Aircraft Rescue and Fire Fighting Vehicles, National Fire Protection Association, 1984, Batterymarch Park, Quincy, MA 02269.

5 Airport Fire and Rescue Vehicle Specification Guide, AC 150/5220-14, March 15, 1979, Federal Aviation Administration, Washington, D.C. 20591.

6 "Air Carrier Overwater Emergency Equipment and Procedures" (NTSB/SS-85/02)

--------------------------------------------------------------------------------------------------------------------------------


http://www.open.gov.uk/aaib/n739pa.htm 

Air Accidents Investigation Branch  
Aircraft Accident Report No 2/90 (EW/C1094)  

------------------------------------------------------------------------
Report on the accident to  
Boeing 747-121, N739PA  
at Lockerbie, Dumfriesshire, Scotland 
on 21December 1988 



------------------------------------------------------------------------


Contents


* SYNOPSIS


* 1. FACTUAL INFORMATION 


* 1.1 History of the flight 
* 1.2 Injuries to persons 
* 1.3 Damage to aircraft 
* 1.4 Other damage 
* 1.5 Personnel information 
* 1.6 Aircraft information 
* 1.7 Meteorological information 
* 1.8 Aids to navigation 
* 1.9 Communications 
* 1.10 Aerodrome information 
* 1.11 Flight recorders 
* 1.12 Wreckage and impact information 
* 1.13 Medical and pathological information 
* 1.14 Fire 
* 1.15 Survival aspects 
* 1.16 Tests and research 
* 1.17 Additional information


* 2. ANALYSIS


* 2.1 Introduction 
* 2.2 Explosive destruction of the aircraft 
* 2.3 Flight recorders 
* 2.4 IED position within the aircraft 
* 2.5 Engine evidence 
* 2.6 Detachment of forward fuselage 
* 2.7 Speed of initial disintegration 
* 2.8 The manoeuvre following the explosion 
* 2.9 Secondary disintegration 
* 2.10 Impact speed of components 
* 2.11 Sequence of disintegration 
* 2.12 Explosive mechanisms and the structural disintegration 
* 2.13 Potential limitation of explosive damage 
* 2.14 Summary


* 3. CONCLUSIONS


* 3.a Findings 
* 3.b Cause


* 4. SAFETY RECOMMENDATIONS 



Appendix A Personnel involved in the investigation 
Figure B-1 Boeing 747 - 121 Leading dimensions 
Figure B-2 Forward fuselage station diagram 
Figure B-3 Network of interlinked cavities 
Figure B-4 Plot of wreckage trails 
Figure B-5, Figure B-6 Figure B-7 Figure B-8 Photographs of model of aircraft
Figure B-9 Photograph of nose and flight deck 
Figure B-10, Figure B-11,Figure B12, Figure B-13 Distribution of major wreckage items located in the southern trail 
Figure B-14 Photograph of two-dimensional layout at Longtown 
Figure B-15 Detail of shatter zone of fuselage 
Figure B-16 Figure B-17 Photographs of three-dimensional reconstruction 
Figure B-18 Plot of floor damage in area of explosion 
Figure B-19 Explosive damage - left side 
Figure B-20 Explosive damage - right side 
Figure B-21 Skin fracture plot 
Figure B-22 Photographs of spar cap embedded in fuselage 
Figure B-23 Initial damage to tailplane 
Figure B-24 Fuselage initial damage sequence 
Figure B-25 Incident shock & region of Mach stem propagation 
Figure B-26 Potential shock & explosive gas propagation paths 
Appendix C Analysis of recorded data 
Figure C-1 Figure C-2 Figure C-3 Figure C-4 Figure C-5 Figure C-6 Figure C-7 Figure C-8 Figure C-9A Figure C-9B Figure C-9C Figure C-9D Figure C-10 Figure C-11 Figure C-12 Figure C-13 Figure C-14 Figure C-15 Figure C-16 Figure C-17 Figure C-18 Figure C-19 Figure C-20 Figure C-21 Figure C-22 Figure C-23 
Appendix D Critical crack calculations 
Appendix E Potential remedial measures 
Appendix E - Figure E-1 
Appendix F Baggage container examination and reconstruction 
Figure F-1 Figure F-2 Figure F-3 Figure F-4 Figure F-5 Figure F-6 Figure F-7 Figure F-8 Figure F-9 Figure F-10 Figure F-11 Figure F-12 Figure F-13 
Appendix G Mach stem shock wave effects 
Figure G-1
------------------------------------------------------------------------
Operator: Pan American World Airways 
Aircraft Type: Boeing 747-121 
Nationality: United States of America 
Registration: N 739 PA
Place of Accident Lockerbie, Dumfries, Scotland 
Latitude 55° 07' N 
Longitude 003° 21' W 
Date and Time (UTC): 21 December 1988 at 19.02:50 hrs 
All times in this report are UTC 
SYNOPSIS

The accident was notified to the Air Accidents Investigation Branch at 19.40 hrs on the 21 December 1988 and the investigation commenced that day. The members of the AAIB team are listed at Appendix A.

The aircraft, Flight PA103 from London Heathrow to New York, had been in level cruising flight at flight level 310 (31,000 feet) for approximately seven minutes when the last secondary radar return was received just before 19.03 hrs. The radar then showed multiple primary returns fanning out downwind. Major portions of the wreckage of the aircraft fell on the town of Lockerbie with other large parts landing in the countryside to the east of the town. Lighter debris from the aircraft was strewn along two trails, the longest of which extended some 130 kilometres to the east coast of England. Within a few days items of wreckage were retrieved upon which forensic scientists found conclusive evidence of a detonating high explosive. The airport security and criminal aspects of the accident are the subject of a separate investigation and are not covered in this report which concentrates on the technical aspects of the disintegration of the aircraft. 

The report concludes that the detonation of an improvised explosive device led directly to the destruction of the aircraft with the loss of all 259 persons on board and 11 of the residents of the town of Lockerbie. Five recommendations are made of which four concern flight recorders, including the funding of a study to devise methods of recording violent positive and negative pressure pulses associated with explosions. The final recommendation is that Airworthiness Authorities and aircraft manufacturers undertake a systematic study with a view to identifying measures that might mitigate the effects of explosive devices and improve the tolerance of the aircraft's structure and systems to explosive damage.

1. FACTUAL INFORMATION

1.1 History of the Flight

Boeing 747, N739PA, arrived at London Heathrow Airport from San Francisco and parked on stand Kilo 14, to the south-east of Terminal 3. Many of the passengers for this aircraft had arrived at Heathrow from Frankfurt, West Germany on a Boeing 727, which was positioned on stand Kilo 16, next to N739PA. These passengers were transferred with their baggage to N739PA which was to operate the scheduled Flight PA103 to New York Kennedy. Passengers from other flights also joined Flight PA103 at Heathrow. After a 6 hour turnround, Flight PA103 was pushed back from the stand at 18.04 hrs and was cleared to taxy on the inner taxiway to runway 27R. The only relevant Notam warned of work in progress on the outer taxiway. The departure was unremarkable.

Flight PA103 took-off at 18.25 hrs. As it was approaching the Burnham VOR it took up a radar heading of 350° and flew below the Bovingdon holding point at 6000 feet. It was then cleared to climb initially to flight level (FL) 120 and subsequently to FL 310. The aircraft levelled off at FL 310 north west of Pole Hill VOR at 18.56 hrs. Approximately 7 minutes later, Shanwick Oceanic Control transmitted the aircraft's oceanic clearance but this transmission was not acknowledged. The secondary radar return from Flight PA103 disappeared from the radar screen during this transmission. Multiple primary radar returns were then seen fanning out downwind for a considerable distance. Debris from the aircraft was strewn along two trails, one of which extended some 130 km to the east coast of England. The upper winds were between 250° and 260° and decreased in strength from 115 kt at FL 320 to 60 kt at FL 100 and 15 to 20 kt at the surface.

Two major portions of the wreckage of the aircraft fell on the town of Lockerbie; other large parts, including the flight deck and forward fuselage section, landed in the countryside to the east of the town. Residents of Lockerbie reported that, shortly after 19.00 hrs, there was a rumbling noise like thunder which rapidly increased to deafening proportions like the roar of a jet engine under power. The noise appeared to come from a meteor-like object which was trailing flame and came down in the north-eastern part of the town. A larger, dark, delta shaped object, resembling an aircraft wing, landed at about the same time in the Sherwood area of the town. The delta shaped object was not on fire while in the air, however, a very large fireball ensued which was of short duration and carried large amounts of debris into the air, the lighter particles being deposited several miles downwind. Other less well defined objects were seen to land in the area. 

1.2 Injuries to persons

Injuries Crew Passengers Others 
Fatal 16 243 11 
Serious - -
Minor/None - -
CLICK HERE TO RETURN TO INDEX
1.3 Damage to aircraft

The aircraft was destroyed

1.4 Other damage

The wings impacted at the southern edge of Lockerbie, producing a crater whose volume, calculated from a photogrammetric survey, was approximately 560 cubic metres. The weight of material displaced by the wing impact was estimated to be well in excess of 1500 tonnes. The wing impact created a fireball, setting fire to neighbouring houses and carrying aloft debris which was then blown downwind for several miles. It was subsequently established that domestic properties had been so seriously damaged as a result of fire and/or impact that 21 had to be demolished and an even greater number of homes required substantial repairs. Major portions of the aircraft, including the engines, also landed on the town of Lockerbie and other large parts, including the flight deck and forward fuselage section, landed in the countryside to the east of the town. Lighter debris from the aircraft was strewn as far as the east coast of England over a distance of 130 kilometres.

1.5 Personnel information


1.5.1 Commander: Male, aged 55 years 
Licence: USA Airline Transport Pilot's Licence 
Aircraft ratings: Boeing 747, Boeing 707, Boeing 720, Lockheed L1011 and Douglas DC3 
Medical Certificate: Class 1,valid to April 1989, with the limitation that the holder shall wear lenses that correct for distant vision and possess glasses that correct for near vision 

Flying experience:
Total all types: 10,910 hours 
Total on type: 4,107 hours 
Total last 28 days 82 hours 
Duty time: Commensurate with company requirements 
Last base check: 11 November 1988 
Last route check: 30 June 1988 
Last emergencies check: 8 November 1988 



1.5.2 Co-pilot: Male, aged 52 years 
Licence: USA Airline Transport Pilot's Licence 
Aircraft ratings: Boeing 747, Boeing 707, Boeing 727 
Medical Certificate: Class 1, valid to April 1989, with the limitation that the holder shall possess correcting glasses for near vision 
Flying experience:
Total all types: 11,855 hours 
Total on type: 5,517 hours 
Total last 28 days: 51 hours 
Duty time: Commensurate with company requirements 
Last base check: 30 November 1988 
Last route check: Not required 
Last emergencies check: 27 November 1988





1.5.3 Flight Engineer: Male, aged 46 years
Licence: USA Flight Engineer's Licence 
Aircraft ratings: Turbojet 
Medical certificate: Class 2, valid to June 1989, with the limitation that the holder shall wear correcting glasses for near vision 
Flying experience:
Total all types: 8,068 hours 
Total on type: 487 hours 
Total last 28 days: 53 hours 
Duty time: Commensurate with company requirements 
Last base check: 30 October 1988 
Last route check: Not required 
Last emergencies check: 27 October 1988




1.5.4 Flight Attendants: There were 13 Flight Attendants on the aircraft, all of whom met company proficiency and medical requirements 
CLICK HERE TO RETURN TO INDEX
1.6 Aircraft information


1.6.1 Leading particulars
Aircraft type: Boeing 747-121 
Constructor's serial number: 19646
Engines: 4 Pratt and Whitney JT9D-7A turbofan 

1.6.2 General description

The Boeing 747 aircraft, registration N739PA, was a conventionally designed long range transport aeroplane. A diagram showing the general arrangement is shown at Appendix B, Figure B-1 together with the principal dimensions of the aircraft.

The fuselage of the aircraft type was of approximately circular section over most of its length, with the forward fuselage having a diameter of 21› feet where the cross-section was constant. The pressurised section of the fuselage (which included the forward and aft cargo holds) had an overall length of 190 feet, extending from the nose to a point just forward of the tailplane. In normal cruising flight the service pressure differential was at the maximum value of 8.9 pounds per square inch. The fuselage was of conventional skin, stringer and frame construction, riveted throughout, generally using countersunk flush riveting for the skin panels. The fuselage frames were spaced at 20 inch intervals and given the same numbers as their stations, defined in terms of the distance in inches from the datum point close to the nose of the aircraft [Appendix B, Figure B-2]. The skin panels were joined using vertical butt joints and horizontal lap joints. The horizontal lap joints used three rows of rivets together with a cold bonded adhesive.

Accommodation within the aircraft was predominately on the main deck, which extended throughout the whole length of the pressurised compartment. A separate upper deck was incorporated in the forward part of the aircraft. This upper deck was reached by means of a spiral staircase from the main deck and incorporated the flight crew compartment together with additional passenger accommodation. The cross-section of the forward fuselage differed considerably from the near circular section of the remainder of the aircraft, incorporating an additional smaller radius arc above the upper deck section joined to the main circular arc of the lower cabin portion by elements of straight fuselage frames and flat skin. 

In order to preserve the correct shape of the aircraft under pressurisation loading, the straight portions of the fuselage frames in the region of the upper deck floor and above it were required to be much stiffer than the frame portions lower down in the aircraft. These straight sections were therefore of very much more substantial construction than most of the curved sections of frames lower down and further back in the fuselage. There was considerable variation in the gauge of the fuselage skin at various locations in the forward fuselage of the aircraft.

The fuselage structure of N739PA differed from that of the majority of Boeing 747 aircraft in that it had been modified to carry special purpose freight containers on the main deck, in place of seats. This was known as the Civil Reserve Air Fleet (CRAF) modification and enabled the aircraft to be quickly converted for carriage of military freight containers on the main deck during times of national emergency. The effect of this modification on the structure of the fuselage was mainly to replace the existing main deck floor beams with beams of more substantial cross-section than those generally found in passenger carrying Boeing 747 aircraft. A large side loading door, generally known as the CRAF door, was also incorporated on the left side of the main deck aft of the wing. 

Below the main deck, in common with other Boeing 747 aircraft, were a number of additional compartments, the largest of which were the forward and aft freight holds used for the storage of cargo and baggage in standard air-transportable containers. These containers were placed within the aircraft hold by means of a freight handling system and were carried on a system of rails approximately 2 feet above the outer skin at the bottom of the aircraft, there being no continuous floor, as such, below these baggage containers. The forward freight compartment had a length of approximately 40 feet and a depth of approximately 6 feet. The containers were loaded into the forward hold through a large cargo door on the right side of the aircraft.

1.6.3 Internal fuselage cavities

Because of the conventional skin, frame and stringer type of construction, common to all large public transport aircraft, the fuselage was effectively divided into a series of 'bays'. Each bay, comprising two adjacent fuselage frames and the structure between them, provided, in effect, a series of interlinking cavities bounded by the frames, floor beams, fuselage skins and cabin floor panels etc. The principal cavities thus formed were:


(i) A semi-circular cavity formed in between the fuselage frames in the lower lobe of the hull, i.e. from the crease beam (at cabin floor level) on one side down to the belly beneath the containers and up to the opposite crease beam, bounded by the fuselage skin on the outside and the containers/cargo liner on the inside [Appendix B, Figure B-3, detail A]. 
(ii) A horizontal cavity between the main cabin floor beams, the cabin floor panels and the cargo bay liner. This extended the full width of the fuselage and linked the upper ends of the lower lobe cavity [Appendix B, Figure B-3, detail B]. 
(iii) A narrow vertical cavity between the two containers [Appendix B, Figure B-3, detail C]. 
(iv) A further narrow cavity around the outside of the two containers, between the container skins and the cargo bay liner, communicating with the lower lobe cavity [Appendix B, Figure B-3, detail D]. 
(v) A continuation of the semi-circular cavity into the space behind the cabin wall liner [Appendix B, Figure B-3, detail E]. This space was restricted somewhat by the presence of the window assembly, but nevertheless provided a continuous cavity extending upwards to the level of the upper deck floor. Forward of station 740, this cavity was effectively terminated at its upper end by the presence of diaphragms which formed extensions of the upper deck floor panels; aft of station 740, the cavity communicated with the ceiling space and the cavity in the fuselage crown aft of the upper deck. 


All of these cavities were repeated at each fuselage bay (formed between pairs of fuselage frames), and all of the cavities in a given bay were linked together, principally at the crease beam area [Appendix B, Figure B-3, region F]. Furthermore, each of the set of bay cavities was linked with the next by the longitudinal cavities formed between the cargo hold liner and the outer hull, just below the crease beam [Appendix B, Figure B-3, detail F]; i.e. this cavity formed a manifold linking together each of the bays within the cargo hold.

The main passenger cabin formed a large chamber which communicated directly with each of the sub floor bays, and also with the longitudinal manifold cavity, via the air conditioning and cabin/cargo bay de-pressurisation vent passages in the crease beam area. (It should be noted that a similar communication did not exist between the upper and lower cabins because there were no air conditioning/depressurisation passages to bypass the upper deck floor.)

1.6.4 Aircraft weight and centre of gravity

The aircraft was loaded within its permitted centre of gravity limits as follows:


Loading: lb kg 
Operating empty weight 366,228 166,120
Additional crew 130 59 
243 passengers (1) 40,324 18,291
Load in compartments: 
1 11,616 5,269 
2 20,039 9,090 
3 15,057 6,830 
4 17,196 7,800 
5 2,544 1,154 
Total in compartments (2) 66,452 30,143
Total traffic load 106,776 48,434
Zero fuel weight 472,156 214,554
Fuel (Take-off) 239,997 108,862
Actual take-off weight(4) 713,002 323,416
Maximum take-off weight 733,992 332,937

Note 1: 
Calculated at standard weights and including cabin baggage.

Note 2: 
Despatch information stated that the cargo did not include dangerous goods, perishable cargo, live animals or known security exceptions. 

1.6.5 Maintenance details

N739PA first flew in 1970 and spent its whole service life in the hands of Pan American World Airways Incorporated. Its Certificate of Airworthiness was issued on 12 February 1970 and remained in force until the time of the accident, at which time the aircraft had completed a total of 72,464 hours flying and 16,497 flight cycles. Details of the last 4 maintenance checks carried out during the aircraft's life are shown below:


DATE SERVICE HOURS CYCLES 
27 Sept 88 C Check (Interior upgrade) 71,502 16,347 
2 Nov 88 B Service Check 71,919 16,406 
27 Nov 88 Base 1 72,210 16,454 
13 Dec 88 Base 2 72,374 16,481 

The CRAF modification programme was undertaken in September 1987. At the same time a series of modifications to the forward fuselage from the nose back to station 520 (Section 41) were carried out to enable the aircraft to continue in service without a continuing requirement for structural inspections in certain areas.

All Airworthiness Directives relating to the Boeing 747 fuselage structure between stations 500 and 1000 have been reviewed and their applicability to this aircraft checked. In addition, Service Bulletins relating to the structure in this area were also reviewed. The applicable Service Bulletins, some of which implement the Airworthiness Directives are listed below together with their subjects. The dates, total aircraft times and total aircraft cycles at which each relevant inspection was last carried out have been reviewed and their status on aircraft N739PA at the time of the accident has been established.

N739PA Service Bulletin compliance:


SB 53-2064 Front Spar Pressure Bulkhead Chord Reinforcement and Drag Splice Fitting Rework. 
Modification accomplished on 6 July 1974. 
Post-modification repetitive inspection IAW (in accordance with) AD 84-18-06 last accomplished on 19 November 1985 at 62,030 TAT hours (Total Aircraft Time) and 14,768 TAC (Total Aircraft Cycles). 
SB 53-2088 Frame to Tension Tie Joint Modification - BS760 to 780. 
Repetitive inspection IAW AD 84-19-01 last accomplished on 19 June 1985 at 60,153 hours TAT and 14,436 TAC. 
SB 53-2200 Lower Cargo Doorway Lower Sill Truss and Latch Support Fitting Inspection Repair and Replacement. 
Repetitive inspection IAW AD 79-17-02 R2 last accomplished 2 November 1988 at 71,919 hours TAT and 16,406 TAC. 
SB 53-2234 Fuselage - Auxiliary Structure - Main Deck Floor - BS 480 Floor Beam Upper Chord Modification. 
Repetitive inspection per SB 53A2263 IAW AD 86-23-06 last accomplished on 26 September 1987 at 67,376 hours TAT and 15,680 TAC. 
SB 53-2237 Fuselage - Main Frame - BS 540 thru 760 and 1820 thru 1900 Frame Inspection and Reinforcement. 
Repetitive inspection IAW AD 86-18-01 last accomplished on 27 February 1987 at 67,088 hours TAT and 15,627 TAC. 
SB 53-2267 Fuselage - Skin - Lower Body Longitudinal Skin Lap Joint and Adjacent Body Frame Inspection and Repair. 
Terminating modification accomplished 100% under wing-to-body fairings and approximately 80% in forward and aft fuselage sections on 26 September 1987 at 67,376 hours TAT and 15,680 TAC. 
Repetitive inspection of unmodified lap joints IAW AD 86-09-07 R1 last accomplished on 18 August 1988 at 71,043 hours TAT and 16,273 TAC. 
SB 53A2303 Fuselage - Nose Section - station 400 to 520 Stringer 6 Skin Lap Splice Inspection, Repair and Modification. 
Repetitive inspection IAW AD 89-05-03 last accomplished on 26 September 1987 at 67,376 hours TAT and 15,680 TAC. 

This documentation, when viewed together with the detailed content of the above service bulletins, shows the aircraft to have been in compliance with the requirements laid down in each of those bulletins. Some maintenance items were outstanding at the time the aircraft was despatched on the last flight, however, none of these items relate to the structure of the aircraft and none had any relevance to the accident.


CLICK HERE TO RETURN TO INDEX
1.7 Meteorological Information 

1.7.1 General weather conditions

An aftercast of the general weather conditions in the area of Lockerbie at about 19.00 hrs was obtained from the Meteorological Office, Bracknell. The synoptic situation included a warm sector covering northern England and most of Scotland with a cold front some 200 nautical miles to the west of the area moving eastwards at about 35 knots. The weather consisted of intermittent rain or showers. The cloud consisted of 4 to 6 oktas of stratocumulus based at 2,200 feet with 2 oktas of altocumulus between 15,000 and 18,000 feet. Visibility was over 15 kilometers and the freezing level was at 8,500 feet with a sub-zero layer between 4,000 and 5,200 feet.

1.7.2 Winds

There was a weakening jet stream of around 115 knots above Flight Level 310. From examination of the wind profile (see below), there appeared to be insufficient shear both vertically and horizontally to produce any clear air turbulence but there may have been some light turbulence.


Flight Level Wind
320 260°/115 knots
300 260°/ 90 knots
240 250°/ 80 knots
180 260°/ 60 knots
100 250°/ 60 knots
050 260°/ 40 knots
Surface 240°/ 15 to 20 gusting 25 to 30 knots 


1.8 Aids to navigation 

Not relevant.

1.9 Communications

The aircraft communicated normally on London Heathrow aerodrome, London control and Scottish control frequencies. Tape recordings and transcripts of all radio telephone (RTF) communications on these frequencies were available.

At 18.58 hrs the aircraft established two-way radio contact with Shanwick Oceanic Area Control on frequency 123.95 MHz. At 19.02:44 hrs the clearance delivery officer at Shanwick transmitted to the aircraft its oceanic route clearance. The aircraft did not acknowledge this message and made no subsequent transmission. 

1.9.1 ATC recording replay

Scottish Air Traffic Control provided copy tapes with time injection for both Shanwick and Scottish ATC frequencies. The source of the time injection on the tapes was derived from the British Telecom "TIM" signal.

The tapes were replayed and the time signals corrected for errors at the time of the tape mounting.

1.9.2 Analysis of ATC tape recordings

From the cockpit voice recorder (CVR) tape it was known that Shanwick was transmitting Flight PA103's transatlantic clearance when the CVR stopped. By synchronising the Shanwick tape and the CVR it was possible to establish that a loud sound was heard on the CVR cockpit area microphone (CAM) channel at 19.02:50 hrs ±1 second.

As the Shanwick controller continued to transmit Flight PA103's clearance instructions through the initial destruction of the aircraft it would not have been possible for a distress call to be received from N739PA on the Shanwick frequency. The Scottish frequency tape recording was listened to from 19.02 hrs until 19.05 hrs for any unexplained sounds indicating an attempt at a distress call but none was heard.

A detailed examination and analysis of the ATC recording together with the flight recorder, radar, and seismic recordings is contained in Appendix C.

1.10 Aerodrome information

Not relevant

1.11 Flight recorders

The Digital Flight Data Recorder (DFDR) and the Cockpit Voice Recorder (CVR) were found close together at UK Ordnance Survey (OS) Grid Reference 146819, just to the east of Lockerbie, and recovered approximately 15 hours after the accident. Both recorders were taken directly to AAIB Farnborough for replay. Details of the examination and analysis of the flight recorders together with the radar, ATC and seismic recordings are contained in Appendix C.

1.11.1 Digital flight data recorder

The flight data recorder installation conformed to ARINC 573B standard with a Lockheed Model 209 DFDR receiving data from a Teledyne Controls Flight Data Acquisition Unit (FDAU). The system recorded 22 parameters and 27 discrete (event) parameters. The flight recorder control panel was located in the flight deck overhead panel. The FDAU was in the main equipment centre at the front end of the forward hold and the flight recorder was mounted in the aft equipment centre.

Decoding and reduction of the data from the accident flight showed that no abnormal behaviour of the data sensors had been recorded and that the recorder had simply stopped at 19.02:50 hrs ±1 second.

1.11.2 Cockpit voice recorder

The aircraft was equipped with a 30 minute duration 4 track Fairchild Model A100 CVR, and a Fairchild model A152 cockpit area microphone (CAM). The CVR control panel containing the CAM was located in the overhead panel on the flight deck and the recorder itself was mounted in the aft equipment centre.

The channel allocation was as follows:-

Channel 1 Flight Engineer's RTF. 
Channel 2 Co-Pilot's RTF. 
Channel 3 Pilot's RTF.
Channel 4 Cockpit Area Microphone. 

The erase facility within the CVR was not functioning satisfactorily and low level communications from earlier recordings were audible on the RTF channels. The CAM channel was particularly noisy, probably due to the combination of the inherently noisy flight deck of the B747-100 in the climb and distortion from the incomplete erasure of the previous recordings. On two occasions the crew had difficulty understanding ATC, possibly indicating high flight deck noise levels. There was a low frequency sound present at irregular intervals on the CAM track but the source of this sound could not be identified and could have been of either acoustic or electrical origin.

The CVR tape was listened to for its full duration and there was no indication of anything abnormal with the aircraft, or unusual crew behaviour. The tape record ended, at 19.02:50 hrs ±1 second, with a sudden loud sound on the CAM channel followed almost immediately by the cessation of recording whilst the crew were copying their transatlantic clearance from Shanwick ATC.

1.12 Wreckage and impact information 

1.12.1 General distribution of wreckage in the field

The complete wing primary structure, incorporating the centre section, impacted at the southern edge of Lockerbie. Major portions of the aircraft, including the engines, also landed in the town. Large portions of the aircraft fell in the countryside to the east of the town and lighter debris was strewn to the east as far as the North Sea. The wreckage was distributed in two trails which became known as the northern and southern trails respectively and these are shown in Appendix B, Figure B-4. A computer database of approximately 1200 significant items of wreckage was compiled and included a brief description of each item and the location where it was found

Appendix B, Figures B-5 to B-8 shows photographs of a model of the aircraft on which the fracture lines forming the boundaries of the separate items of structure have been marked. The model is colour coded to illustrate the way in which the wreckage was distributed between the town of Lockerbie and the northern and southern trails.

1.12.1.1 The crater

The aircraft wing impacted in the Sherwood Crescent area of the town leaving a crater approximately 47 metres (155 feet) long with a volume calculated to be 560 cubic metres.

The projected distance, measured parallel from one leading edge to the other wing tip, of the Boeing 747-100 was approximately 143 feet, whereas the span is known to be 196 feet. This suggests that impact took place with the wing structure yawed. Although the depth of the crater varied from one end to the other, its widest part was clearly towards the western end suggesting that the wing structure impacted whilst orientated with its root and centre section to the west.

The work carried out at the main crater was limited to assessing the general nature of its contents. The total absence of debris from the wing primary structure found remote from the crater confirmed the initial impression that the complete wing box structure had been present at the main impact.

The items of wreckage recovered from or near the crater are coloured grey on the model at Appendix B, Figures B-5 to B-8.

1.12.1.2 The Rosebank Crescent site

A 60 feet long section of fuselage between frame 1241 (the rear spar attachment) and frame 1960 (level with the rear edge of the CRAF cargo door) fell into a housing estate at Rosebank Crescent, just over 600 metres from the crater. This section of the fuselage was that situated immediately aft of the wing, and adjoined the wing and fuselage remains which produced the crater. It is colour coded yellow on the model at Appendix B, Figures B-5 to B-8. All fuselage skin structure above floor level was missing except for the following items:

Section containing 3 windows between door 4L and CRAF door;
The CRAF door itself (latched) apart from the top area containing the hinge;
Window belt containing 8 windows aft of 4R door aperture
Window belt containing 3 windows forward of 4R door aperture; 
Door 4R.

Other items found in the wreckage included both body landing gears, the right wing landing gear, the left and right landing gear support beams and the cargo door (frames 1800-1920) which was latched. A number of pallets, luggage containers and their contents were also recovered from this site.

1.12.1.3 Forward fuselage and flight deck section.

The complete fuselage forward of approximately station 480 (left side) to station 380 (right side) and incorporating the flight deck and nose landing gear was found as a single piece [Appendix B, Figure B-9] in a field approximately 4 km miles east of Lockerbie at OS Grid Reference 174808. It was evident from the nature of the impact damage and the ground marks that it had fallen almost flat on its left side but with a slight nose-down attitude and with no discernible horizontal velocity. The impact had caused almost complete crushing of the structure on the left side. The radome and right nose landing gear door had detached in the air and were recovered in the southern trail.

Examination of the torn edges of the fuselage skin did not indicate the presence of any pre-existing structural or material defects which could have accounted for the separation of this section of the fuselage. Equally so, there were no signs of explosive blast damage or sooting evident on any part of the structure or the interior fittings. It was noted however that a heavy, semi-eliptical scuff mark was present on the lower right side of the fuselage at approximately station 360. This was later matched to the intake profile of the No 3 engine.

The status of the controls and switches on the flight deck was consistent with normal operation in cruising flight. There were no indications that the crew had attempted to react to rapid decompression or loss of control or that any emergency preparations had been actioned prior to the catastrophic disintegration.

1.12.1.4 Northern trail

The northern trail was seen to be narrow and clearly defined, to emanate from a point very close to the main impact crater and to be orientated in a direction which agreed closely with the mean wind aftercast for the height band from sea level to 20,000 ft. Also at the western end of the northern trail were the lower rear fuselage at Rosebank Crescent, and the group of Nos. 1, 2 and 4 engines which fell in Lockerbie.

The trail contained items of structure distributed throughout its length, from the area slightly east of the crater, to a point approximately 16 km east, beyond which only items of low weight / high drag such as insulation, interior trim, paper etc, were found. For all practical purposes this trail ended at a range of 25 km.

The northern trail contained mainly wreckage from the rear fuselage, fin and the inner regions of both tailplanes together with structure and skin from the upper half of the fuselage forward to approximately the wing mid-chord position. A number of items from the wing were also found in the northern trail, including all 3 starboard Kreuger flaps, most of the remains of the port Kreuger flaps together with sections of their leading edge attachment structures, one portion of outboard aileron approximately 10 feet long, the aft ends of the flap-track fairings (one with a slide raft wrapped around it), and fragments of glass reinforced plastic honeycombe structure believed to be from the flap system, i.e. fore-flaps, aft-flaps, mid-flaps or adjacent fairings. In addition, a number of pieces of the engine cowlings and both HF antennae (situated projecting aft from the wing-tips) were found in this trail.

All items recovered from the northern trail, with the exception of the wing, engines, and lower rear fuselage in Rosebank Crescent, are coloured red on the model of the aircraft in Appendix B, Figures B-5 to B-8.

1.12.1.5 Southern trail

The southern trail was easily defined, except within 12 km of Lockerbie where it tended to merge with the northern trail. Further east, it extended across southern Scotland and northern England, essentially in a straight band as far as the North Sea. Most of the significant items of wreckage were found in this trail within a range of 30 km from the main impact crater. Items recovered from the southern trail are coloured green on the model of the aircraft at Appendix B, Figures B-5 to B-8.

The trail contained numerous large items from the forward fuselage. The flight deck and nose of the aircraft fell in the curved part of this trail close to Lockerbie. Fragments of the whole of the left tailplane and the outboard portion of the right tailplane were distributed almost entirely throughout the southern trail. Between 21 and 27 km east of the main impact point (either side of Langholm) substantial sections of tailplane skin were found, some bearing distinctive signs of contact with debris moving outwards and backwards relative to the fuselage. Also found in this area were numerous isolated sections of fuselage frame, clearly originating from the crown region above the forward upper deck.

1.12.1.6 Datum line

All grid references relating to items bearing actual explosive evidence, together with those attached to heavily distorted items found to originate immediately adjacent to them on the structure, were plotted on an Ordnance Survey (OS) chart. These references, 11 in total, were all found to be distributed evenly about a mean line orientated 079°(Grid) within the southern trail and were spread over a distance of 12 km. The distance of each reference from the line was measured in a direction parallel to the aircraft's track and all were found to be within 500 metres of the line, with 50% of them being within 250 metres of the line. This line is referred to as the datum line and is shown in Appendix B, Figure B-4.

1.12.1.7 Distribution of wreckage within the southern trail

North of the datum line and parallel to it were drawn a series of lines at distances of 250, 300, 600 and 900 metres respectively from the line, again measured in a direction parallel to the aircraft's track. The positions on the aircraft structure of specific items of wreckage, for which grid references were known with a high degree of confidence, within the bands formed between these lines, are shown in Appendix B, Figures B-10 to 13. In addition, a separate assessment of the grid references of tailplane and elevator wreckage established that these items were distributed evenly about the 600 metre line.

1.12.1.8 Area between trails

Immediately east of the crater, the southern trail converged with the northern trail such that, to an easterly distance of approximately 5 km, considerable wreckage existed which could have formed part of either trail. Further east, between 6 and 11 km from the crater, a small number of sections and fragments of the fin had fallen outside the southern boundary of the northern trail. Beyond this a large area existed between the trails in which there was no wreckage.

1.12.2 Examination of wreckage at CAD Longtown

The debris from all areas was recovered by the Royal Air Force to the Army Central Ammunition Depot Longtown, about 20 miles from Lockerbie. Approximately 90% of the hull wreckage was successfully recovered, identified, and laid out on the floor in a two-dimensional reconstruction [Appendix B, Figure B-14]. Baggage container material was incorporated into a full three-dimensional reconstruction. Items of wreckage added to the reconstructions was given a reference number and recorded on a computer database together with a brief description of the item and the location where it was found.

1.12.2.1 Fuselage

The reconstruction revealed the presence of damage consistent with an explosion on the lower fuselage left side in the forward cargo bay area. A small region of structure bounded approximately by frames 700 & 720 and stringers 38L & 40L, had clearly been shattered and blasted through by material exhausting directly from an explosion centred immediately inboard of this location. The material from this area, hereafter referred to as the 'shatter zone', was mostly reduced to very small fragments, only a few of which were recovered, including a strip of two skins [Appendix B, Figure B-15] forming part of the lap joint at the stringer 39L position.

Surrounding the shatter zone were a series of much larger panels of torn fuselage skin which formed a 'star-burst' fracture pattern around the shatter zone. Where these panels formed the boundary of the shatter zone, the metal in the immediate locality was ragged, heavily distorted, and the inner surfaces were pitted and sooted - rather as if a very large shotgun had been fired at the inner surface of the fuselage at close range. In contrast, the star-burst fractures, outside the boundary of the shatter zone, displayed evidence of more typical overload tearing, though some tears appeared to be rapid and, in the area below the missing panels, were multi-branched. These surrounding skin panels were moderately sooted in the regions adjacent to the shatter zone, but otherwise were lightly sooted or free of soot altogether. (Forensic analysis of the soot deposits on frame and skin material from this area confirmed the presence of explosive residues.) All of these skin panels had pulled away from the supporting structure and had been bent and torn in a manner which indicated that, as well as fracturing in the star burst pattern, they had also petalled outwards producing characteristic, tight curling of the sheet material.

Sections of frames 700 and 720 from the area of the explosion were also recovered and identified. Attached to frame 720 were the remnants of a section of the aluminium baggage container (side) guide rail, which was heavily distorted and displayed deep pitting together with very heavy sooting, indicating that it had been very close to the explosive charge. The pattern of distortion and damage on the frames and guide rail segment matched the overall pattern of damage observed on the skins.

The remainder of the structure forming the cargo deck and lower hull was, generally, more randomly distorted and did not display the clear indications of explosive processes which were evident on the skin panels and frames nearer the focus of the explosion. Nevertheless, the overall pattern of damage was consistent with the propagation of explosive pressure fronts away from the focal area inboard of the shatter zone. This was particularly evident in the fracture and bending characteristics of several of the fuselage frames ahead of, and behind station 700.

The whole of the two-dimensional fuselage reconstruction was examined for general evidence of the mode of disintegration and for signs of localised damage, including overpressure damage and pre-existing damage such as corrosion or fatigue. There was some evidence of corrosion and dis-bonding at the cold-bond lap joints in the fuselage. However, the corrosion was relatively light and would not have compromised significantly the static strength of the airframe. Certainly, there was no evidence to suggest that corrosion had affected the mode of disintegration, either in the area of the explosion or at areas more remote. Similarly, there were no indications of fatigue damage except for one very small region of fatigue, involving a single crack less than 3 inches long, which was remote from the bomb location. This crack was not in a critical area and had not coincided with a fracture path.

No evidence of overpressure fracture or distortion was found at the rear pressure bulkhead. Some suggestion of 'quilting' or 'pillowing' of skin panels between stringers and frames, indicative of localised overpressure, was evident on the skin panels attached to the larger segments of lower fuselage wreckage aft of the blast area. In addition, the mode of failure of the butt joint at station 520 suggested that there had been a rapid overpressure load in this area, causing the fastener heads to 'pop' in the region of stringers 13L to 16L, rather than producing shear in the fasteners. Further evidence of localised overpressure damage remote from the source of the explosion was found during the full three-dimensional reconstruction, detailed later in paragraph 1.12.3.2.

An attempt was made to analyse the fractures, to determine the direction and sequence of failure as the fractures propagated away from the region of the explosion. It was found that the directions of most of the fractures close to the explosion could be determined from an analysis of the fracture surfaces and other features, such as rivet and rivet hole distortions. However, it was apparent that beyond the boundary of the petalled region, the disintegration process had involved multiple fractures taking place simultaneously - extremely complex parallel processes which made the sequencing of events not amenable to conventional analysis. 


CLICK HERE TO RETURN TO INDEX
1.12.2.2 Wing structure and adjacent fuselage area

On completion of the initial layout at Longtown it became evident that, in the area from station 1000 to approximately station 1240 the only identifiable fuselage structure consisted of elements of fuselage skin, stringers and frames from above the cabin window belts. The wreckage from in and around the crater was therefore sifted to establish more accurately what sections of the aircraft had produced the crater. All of the material was highly fragmented, but it was confirmed that the material comprised mostly wing structure, with a few fragments of fuselage sidewall and passenger seats. The badly burnt state of these fragments made it clear that they were recovered from the area of the main impact crater, the only scene of significant ground fire. Amongst these items a number of cabin window forgings were recovered with sections of thick horizontal panelling attached having a length equivalent to the normal window spacing/frame pitch. This arrangement, with skins of this thickness, is unique to the area from station 1100 to 1260. It is therefore reasonable to assume that these fragments formed parts of the missing cabin sides from station 1000 to station 1260, which must have remained attached to the wing centre section at the time of its impact. Because of the high degree of fragmentation and the relative insignificance of the wing in terms of the overall explosive damage pattern, a reconstruction of the wing material was not undertaken. The sections of the aircraft which went into the crater are colour coded grey in Appendix B, Figures B-5 to B-8.

1.12.2.3 Fin and aft section of fuselage

Examination of the structure of the fin revealed evidence of in-flight damage to the leading edge caused by the impact of structure or cabin contents. This damage was not severe or extensive and the general break-up of the fin did not suggest either a single readily defined loading direction, or break-up due to the effects of leading edge impact. A few items of fin debris were found between the northern and southern trails.

A number of sections of fuselage frame found in the northern trail exhibited evidence of plastic deformation of skin attachment cleats and tensile overload failure of the attachment rivets. This damage was consistent with that which would occur if the skin had been locally subjected to a high loading in a direction normal to its plane. Although this was suggestive of an internal overpressure condition, the rear fuselage revealed no other evidence to support this possibility. Examination of areas of the forward fuselage known to have been subjected to high blast overpressures revealed no comparable evidence of plastic deformation in the skin attachment cleats or rivets, most skin attachment failures appearing to have been rapid.

Calculations made on the effects of internal pressure generated by an open ended fuselage descending at the highest speed likely to have been experienced revealed that this could not generate an internal pressure approaching that necessary to cause failure in an intact cabin structure.

1.12.2.4 Baggage containers

During the wreckage recovery operation it became apparent that some items, identified as parts of baggage containers, exhibited damage consistent with being close to a detonating high explosive. It was therefore decided to segregate identifiable container parts and reconstruct any that showed evidence of explosive damage. It was evident, from the main wreckage layout, that the explosion had occurred in the forward cargo hold and, although all baggage container wreckage was examined, only items from this area which showed the relevant characteristics were considered for the reconstruction. Discrimination between forward and rear cargo hold containers was relatively straightforward as the rear cargo hold wreckage was almost entirely confined to Lockerbie, whilst that from the forward hold was scattered along the southern wreckage trail. 

All immediately identifiable parts of the forward cargo containers were segregated into areas designated by their serial numbers and items not identified at that stage were collected into piles of similar parts for later assessment. As a result of this, two adjacent containers, one of metal construction the other fibreglass, were identified as exhibiting damage likely to have been caused by the explosion. Those parts which could be positively identified as being from these two containers were assembled onto one of three simple wooden frameworks, one each for the floor and superstructure of the metal container and one for the superstructure of the fibreglass container. From this it was positively determined that the explosion had occurred within the metal container (serial number AVE 4041 PA), the direct effects of this being evident also on the forward face of the adjacent fibreglass container (serial number AVN 7511 PA) and on the local airframe on the left side of the aircraft in the region of station 700. It was therefore confirmed that this metal container had been loaded in position 14L in agreement with the aircraft loading records. While this work was in progress a buckled section of the metal container skin was found by an AAIB Inspector to contain, trapped within its folds, an item which was subsequently identified by forensic scientists at the Royal Armaments Research and Development Establishment (RARDE) as belonging to a specific type of radio-cassette player and that this had been fitted with an improvised explosive device (IED).

The reconstruction of these containers and their relationship to the aircraft structure is described in detail in Appendix F. Examination of all other components of the remaining containers revealed only damage consistent with ejection into the high speed slipstream and/or ground impact, and that only one device had detonated within the containers on board the aircraft.

1.12.3 Fuselage three-dimensional reconstruction

1.12.3.1 The reconstruction

The two-dimensional reconstruction successfully established that there had been an explosion in the forward hold; its location was established and the general damage characteristics in the vicinity of the explosion were determined. However, the mechanisms by which the failure process developed from local damage in the immediate vicinity of the explosion to the complete structural break-up and separation of the whole forward section of the fuselage, could not be adequately investigated without recourse to a more elaborate reconstruction.

To facilitate this additional work, wreckage forming a 65 foot section of the fuselage (approximately 30 feet each side of the explosion) was transported to AAIB Farnborough, where it was attached to a specially designed framework to form a fully three-dimensional reconstruction [Appendix B, Figures B-16 and B-17] of the complete fuselage between stations 360 & 1000 (from the separated nose section back to the wing cut out). The support framework was designed to provide full and free access to all parts of the structure, both internally and externally. Because of height constraints, the reconstruction was carried out in two parts, with the structure divided along a horizontal line at approximately the upper cabin floor level. The previously reconstructed containers were also transported to AAIB Farnborough to allow correlation of evidence with, and partial incorporation into, the fuselage reconstruction. 

Structure and skin panels were attached to the supporting framework by their last point of attachment, to provide a better appreciation of the modes and direction of curling, distortion, and ultimate separation. Thus, the panels of skin which had petalled back from the shatter zone were attached at their outer edges, so as to identify the bending modes of the panels, the extent of the petalled region, and also the size of the resulting aperture in the hull. In areas more remote from the explosion, the fracture and tear directions were used together with distortion and curling directions to determine the mode of separation, and thus the most appropriate point of attachment to the reconstruction. Cabin floor beam segments were supported on a steel mesh grid and a plot of the beam fractures is shown at Appendix B, Figure B-18. 

The cargo container base elements were separated from the rest of the container reconstruction and transferred to the main wreckage reconstruction, where the re-assembled container base was positioned precisely onto the cargo deck. To assist in the correlation of the initial shatter zone and petalled-out regions with the position of the explosive device, the boundaries of the skin panel fractures were marked on a transparent plastic panel which was then attached to the reconstruction to provide a transparent pseudo-skin showing the positions of the skin tear lines. This provided a clear visual indication of the relationship between the skin panel fractures and the explosive damage to the container base, thus providing a more accurate indication of the location of the explosive device. 

1.12.3.2 Summary of explosive features evident

The three-dimensional reconstruction provided additional information about the region of tearing and petalling around the shatter zone. It also identified a number of other regions of structural damage, remote from the explosion, which were clearly associated with severe and rapidly applied pressure loads acting normal to the skin's internal surface. These were sufficiently sharp-edged to pre-empt the resolution of pressure induced loads into membrane tension stresses in the skin: instead, the effect was as though these areas of skin had been struck a severe 'pressure blow' from within the hull.

The two types of damage, i.e. the direct blast/tearing/petalling damage and the quite separate areas of 'pressure blow' damage at remote sites were evidently caused by separate mechanisms, though it was equally clear that each was caused by explosive processes, rather than more general disintegration.

The region of petalling was bounded (approximately) by frames 680 and 740, and extended from just below the window belt down nearly to the keel of the aircraft [Appendix B, Figure B-19, region A]. The resulting aperture measured approximately 17 feet by 5 feet. Three major fractures had propagated beyond the boundary of the petalled zone, clearly driven by a combination of hull pressurisation loading and the relatively long term (secondary) pressure pulse from the explosion. These fractures ran as follows: 


(i) rearwards and downward in a stepped fashion, joining the stringer 38L lap joint at around station 840, running aft along stringer 38L to around station 920, then stepping down to stringer 39L and running aft to terminate at the wing box cut-out [Appendix B, Figure B-19, fracture 1]. 
(ii) downwards and forward to join the stringer 44L lap joint, then running forward along stringer 44L as far as station 480 [Appendix B, Figure B-19, fracture 2]. 
(iii) downwards and rearward, joining the butt line at station 740 to run under the fuselage and up the right side to a position approximately 18 inches above the cabin floor level [Appendix B, Figures B-19 and B-20, fracture 3]. 

The propagation of tears upwards from the shatter zone appeared to have taken the form of a series of parallel fractures running upwards together before turning towards each other and closing, forming large flaps of skin which appear to have separated relatively cleanly.

Regions of skin separation remote from the site of the explosion were evident in a number of areas. These principally were:


(i) A large section of upper fuselage skin extending from station 500 back to station 760, and from around stringers 15/19L up as far as stringer 5L [Appendix B, Figures B-19 and B-20, region B], and probably extending further up over the crown. This panel had separated initially at its lower forward edge as a result of a pressure blow type of impulse loading, which had popped the heads from the rivets at the butt joint on frame 500 and lifted the skin flap out into the airflow. The remainder of the panel had then torn away rearwards in the airflow. 
A region of 'quilting' or 'pillowing', i.e. spherical bulging of skin panels between frames and stringers, was evident on these panels in the region between station 560 and 680, just below the level of the upper deck floor, indicative of high internal pressurisation loading [Appendix B, Figure B-19, region C]. 
(ii) A smaller section of skin between stations 500 and 580, bounded by stringers 27L and 34L [Appendix B, Figure B-19, region D], had also been 'blown' outwards at its forward edge and torn off the structure rearwards. A characteristic curling of the panel was evident, consistent with rapid, energetic separation from the structure. 
(iii) A section of thick belly skin extending from station 560, stringers 40R to 44R, and tapering back to a point at stringer 45R/station720 [Appendix B, Figure B-19 and B-20, region E], had separated from the structure as a result of a very heavy 'pressure blow' load at its forward end which had popped the heads off a large number of substantial skin fasteners. The panel had then torn away rearwards from the structure, curling up tightly onto itself as it did so - indicating that considerable excess energy was involved in the separation process (over and above that needed simply to separate the skin material from its supporting structure). 
(iv) A panel of skin on the right side of the aircraft, roughly opposite the explosion, had been torn off the frames, beginning at the top edge of the panel situated just below the window belt and tearing downwards towards the belly [Appendix B, Figure B-20, region F]. This panel was curled downwards in a manner which suggested significant excess energy. 

Appendix B, Figure B-21 shows a plot of the fractures noted in the fuselage skins between stations 360 and 1000.

The cabin floor structure was badly disrupted, particularly in the general area above the explosion, where the floor beams had suffered localised upward loading sufficient to fracture them, and the floor panels were missing. Elsewhere, floor beam damage was mainly limited to fractures at the outer ends of the beams and at the centreline, leaving sections of separated floor structure comprising a number of half beams joined together by the Nomex honeycomb floor panels.

1.12.3.3 General damage features not directly associated with explosive forces.

A number of features appeared to be a part of the general structural break-up which followed on from the explosive damage, rather than being a part of the explosive damage process itself. This general break-up was complex and, to a certain extent, random. However, analysis of the fractures, surface scores, paint smears and other features enabled a number of discreet elements of the break-up process to be identified. These elements are summarised below. 


(i) Buckling of the window belts on both sides of the aircraft was evident between stations 660 and 800. That on the left side appeared to be the result of in-plane bending in a nose up sense, followed by fracture. The belt on the right side had a large radius curve suggesting lateral deflection of the fuselage possibly accompanied by some longitudinal compression. This terminated in a peeling failure of the riveted joint at station 800. 
(ii) On the left side three fractures, apparently resulting from in-plane bending/buckling distortion, had traversed the window belt [Appendix B, Figure B-21, detail G]. Of these, the forward two had broken through the window apertures and the aft fracture had exploited a rivet line at the region of reinforcement just forward of the L2 door aperture. On the right side, the window belt had peeled rearwards, after buckling had occurred, separating from the rest of the fuselage, following rivet failure, at the forward edge of the R2 door aperture. 
(iii) All crown skins forward of frame 840 were badly distorted and a number of pieces were missing. It was clearly evident that the skin sections from this region had struck the empennage and/or other structure following separation. 
(iv) The fuselage left side lower lobe from station 740 back to the wing box cut-out, and from the window level down to the cargo deck floor (the fracture line along stringer 38L), had peeled outwards, upwards and rearwards - separating from the rest of the fuselage at the window belt. The whole of this separated section had then continued to slide upwards and rearwards, over the fuselage, before being carried back in the slipstream and colliding with the outer leading edge of the right horizontal stabiliser, completely disrupting the outer half. A fragment of horizontal stabiliser spar cap was found embedded in the fuselage structure adjacent to the two vent valves, just below, and forward of, the L2 door [Appendix B, Figure B-22]. 
(v) A large, clear, imprint of semi-eliptical form was apparent on the lower right side at station 360 which had evidently been caused by the separating forward fuselage section striking the No 3 engine as it swung rearwards and to the right (confirmed by No 3 engine fan cowl damage). 

1.12.3.4 Tailplane three-dimensional reconstruction 

The tailplane structural design took the form of a forward and an aft torque box. The forward box was constructed from light gauge aluminium alloy sheet skins, supported by closely pitched, light gauge nose ribs but without lateral stringers. The aft torque box incorporated heavy gauge skin/stringer panels with more widely spaced ribs. The front spar web was of light gauge material. Leading edge impacts inflicted by debris would therefore have had the capacity to reduce the tailplane's structural integrity by passing through the light gauge skins and spar web into the interior of the aft torque box, damaging the shear connection between top and bottom skins in the process and thereby both removing the bending strength of the box and opening up the weakened structure to the direct effects of the airflow.

Examination of the rebuilt tailplane structure at AAIB Farnborough left little doubt that it had been destroyed by debris striking its leading edges. In addition, the presence on the skins of smear marks indicated that some unidentified soft debris had contacted those surfaces whilst moving with both longitudinal and lateral velocity components relative to the aircraft.

The reconstructed left tailplane [Appendix B, Figure B-23] showed evidence that disruption of the inboard leading edge, followed respectively by the forward torque box, front spar web and main torque box, occurred as a result of frontal impact by the base of a baggage container. Further outboard, a compact object appeared to have struck the underside of the leading edge and penetrated to the aft torque box. In both cases, the loss of the shear web of the front spar appeared to have permitted local bending failure of the remaining main torque box structure in a tip downwards sense, consistent with the normal load direction. For both events to have occurred it would be reasonable to assume that the outboard damage preceded that occurring inboard.

The right tailplane exhibited massive leading edge impact damage on the outboard portion which also appeared to have progressed to disruption of the aft torsion box. A fragment of right tailplane spar cap was found embedded in the fuselage structure adjacent to the two vent valves, just below, and forward of, the L2 door and it is clear that this area of forward left fuselage had travelled over the top of the aircraft and contributed to the destruction of the outboard right tailplane.


CLICK HERE TO RETURN TO INDEX
1.12.4 Examination of engines

All four engines had struck the ground in Lockerbie with considerable velocity and therefore sustained major damage, in particular to most of the fan blades. The No 3 engine had fallen 1,100 metres north of the other three engines, striking the ground on its rear face, penetrating a road surface and coming to rest without any further change of orientation i.e. with the front face remaining uppermost. The intake area contained a number of loose items originating from within the cabin or baggage hold. It was not possible initially to determine whether any of the general damage to any of the engine fans or the ingestion noted in No 3 engine intake occurred whilst the relevant engines were delivering power or at a later stage. 

Numbers 1, 2 and 3 engines were taken to British Airways Engine Overhaul Limited for detailed examination under AAIB supervision in conjunction with a specialist from the Pratt and Whitney Engine Company. During this examination the following points were noted: 


(i) No 2 engine (situated closest to the site of the explosion) had evidence of blade "shingling" in the area of the shrouds consistent with the results of major airflow disturbance whilst delivering power. (This effect is produced when random bending and torsional deflection occurs, permitting the mid-span shrouds to disengage and repeatedly strike the adjacent aerofoil surfaces of the blades). The interior of the air intake contained paint smears and other evidence suggesting the passage of items of debris. One such item of significance was a clear indentation produced by a length of cable of diameter and strand size similar to that typically attached to the closure curtains on the baggage containers. 
(ii) No 3 engine, identified on site as containing ingested debris from within the aircraft, nonetheless had no evidence of the type of shingling seen on the blades of No 2 engine. Such evidence is usually unmistakable and its absence is a clear indication that No 3 engine did not suffer a major intake airflow disturbance whilst delivering significant power. The intake structure was found to have been crushed longitudinally by an impact on the front face although, as stated earlier, it had struck the ground on its rear face whilst falling vertically. 
(iii) All 3 engines had evidence of blade tip rubs on the fan cases having a combination of circumference and depth greater than hitherto seen on any investigation witnessed on Boeing 747 aircraft by the Pratt and Whitney specialists. Subsequent examination of No 4 engine confirmed that it had a similar deep, large circumference tip rub. These tip-rubs on the four engines were centred at slightly different clock positions around their respective fan cases. 

The Pratt and Whitney specialists supplied information which was used to interpret the evidence found on the blades and fan cases including details of engine dynamic behaviour necessary to produce the tip rub evidence. This indicated that the depth and circumference of tip rubs noted would have required a marked nose down change of aircraft pitch attitude combined with a roll rate to the left. 

Pratt and Whitney also advised that:


(i) Airflow disruption such as that presumed to have caused the shingling observed on No 2 engine fan blades was almost invariably the result of damage to the fan blade aerofoils, resulting from ingestion or blade failure. 
(ii) Tip rubs of a depth and circumference noted on all four engines could be expected to reduce the fan rotational energy on each to a negligible value within approximately 5 seconds. 
(iii) Airflow disruption sufficient to cause the extent of shingling noted on the fan blades of No 2 engine would also reduce the rotational fan energy to a negligible value within approximately 5 seconds. 

1.13 Medical and pathological information 

The results of the post mortem examination of the victims indicated that the majority had experienced severe multiple injuries at different stages, consistent with the in-flight disintegration of the aircraft and ground impact. There was no pathological indication of an in-flight fire and no evidence that any of the victims had been injured by shrapnel from the explosion. There was also no evidence which unequivocally indicated that passengers or cabin crew had been killed or injured by the effects of a blast. Although it is probable that those passengers seated in the immediate vicinity of the explosion would have suffered some injury as a result of blast, this would have been of a secondary or tertiary nature. 

Of the casualties from the aircraft, the majority were found in areas which indicated that they had been thrown from the fuselage during the disintegration. Although the pattern of distribution of bodies on the ground was not clear cut there was some correlation with seat allocation which suggested that the forward part of the aircraft had broken away from the rear early in the disintegration process. The bodies of 10 passengers were not recovered and of these, 8 had been allocated seats in rows 23 to 28 positioned over the wing at the front of the economy section. The fragmented remains of 13 passengers who had been allocated seats around the eight missing persons were found in or near the crater formed by the wing. Whilst there is no unequivocal proof that the missing people suffered the same fate, it would seem from the pattern that the missing passengers remained attached to the wing structure until impact.

1.14 Fire

Of the several large pieces of aircraft wreckage which fell in the town of Lockerbie, one was seen to have the appearance of a ball of fire with a trail of flame. Its final path indicated that this was the No 3 engine, which embedded itself in a road in the north-east part of the town. A small post impact fire posed no hazard to adjacent property and was later extinguished with water from a hosereel. The three remaining engines landed in the Netherplace area of the town. One severed a water main and the other two, although initially on fire, were no risk to persons or property and the fires were soon extinguished.

A large, dark, delta shaped object was seen to fall at about the same time in the Sherwood area of the town. It was not on fire while in the air, however, a fireball several hundred feet across followed the impact. It was of relatively short duration and large amounts of debris were thrown into the air, the lighter particles being carried several miles downwind, while larger pieces of burning debris caused further fires, including a major one at the Townfoot Garage, up to 350 metres from the source. It was determined that the major part of both wings, which included the aircraft fuel tanks, had formed the crater. A gas main had also been ruptured during the impact.

At 19.04 hrs the Dumfries Fire Brigade Control received a call from a member of the public which indicated that there had been a "huge boiler explosion" at Westacres, Lockerbie, however, subsequent calls soon made it clear that it was an aircraft which had crashed. At 19.07 hrs the first appliances were mobile and at 1910 hrs one was in attendance in the Rosebank area. Multiple fires were identified and it soon became apparent that a major disaster had occurred in the town and the Fire Brigade Major Incident Plan was implemented. During the initial phase 15 pumping appliances from various brigades were deployed but this number was ultimately increased to 20.

At 22.09 hrs the Firemaster made an assessment of the situation. He reported that there was a series of fires over an area of the town centre extending 1› by € mile. The main concentration of the fire was in the southwest of the town around Sherwood Park and Sherwood Crescent. Appliances were in attendance at other fires in the town, particularly in Park Place and Rosebank Crescent. Water and electricity supplies were interrupted and water had to be brought into the town.

By 02.22 hrs on 22 December, all main seats of fire had been extinguished and the firemen were involved in turning over and damping down. At 04.42 hrs small fires were still occurring but had been confined to the Sherwood Crescent area.


1.15 Survival aspects

1.15.1 Survivability

The accident was not survivable.

1.15.2 Emergency services

A chronology of initial responses by the emergency services is listed below:-


Time Event 
19.03 hrs Radio message from Police patrol in Lockerbie to Dumfries and Galloway Constabulary reporting an aircraft crash at Lockerbie. 
19.04 hrs Emergency call to Dumfries and Galloway Fire Brigade. 
19.37 hrs First ambulances leave for Dumfries and Galloway Royal Infirmary with injured town residents. (2- serious; 3- minor) 
19.40 hrs Sherwood Park and Sherwood Crescent residents evacuated to Lockerbie Town Hall. 
20.25 hrs Nose section of N739PA discovered at Tundergarth (approximately 4 km east of Lockerbie). 

During the next few days a major emergency operation was mounted using the guidelines of the Dumfries and Galloway Regional Peacetime Emergency Plan. The Dumfries and Galloway Constabulary was reinforced by contingents from Strathclyde and Lothian & Borders Constabularies. Resources from HM Forces were made available and this support was subsequently authorised by the Ministry of Defence as Military Aid to the Civil Power. It included the provision of military personnel and a number of helicopters used mainly in the search for and recovery of aircraft wreckage. It was apparent at an early stage that there were no survivors from the aircraft and the search and recovery of bodies was mainly a Police task with military assistance.

Many other agencies were involved in the provision of welfare and support services for the residents of Lockerbie, relatives of the aircraft's occupants and personnel involved in the emergency operation.



CLICK HERE TO RETURN TO INDEX
1.16 Tests and research

An explosive detonation within a fuselage, in reasonably close proximity to the skin, will produce a high intensity spherically propagating shock wave which will expand outwards from the centre of detonation. On reaching the inner surface of the fuselage skin, energy will partially be absorbed in shattering, deforming and accelerating the skin and stringer material in its path. Much of the remaining energy will be transmitted, as a shock wave, through the skin and into the atmosphere but a significant amount of energy will be returned as a reflected shock wave, which will travel back into the fuselage interior where it will interact with the incident shock to produce Mach stem shocks - re-combination shock waves which can have pressures and velocities of propagation greater than the incident shock.

The Mach stem phenomenon is significant because it gives rise (for relatively small charge sizes) to a geometric limitation on the area of skin material which the incident shock wave can shatter, irrespective of charge size, thus providing a means of calculating the standoff distance of the explosive charge from the fuselage skin. Calculations suggest that a charge standoff distance of aproximately 25 inches would result in a shattered region approximately 18 to 20 inches in diameter, comparable to the size of the shattered region evident in the wreckage. This aspect is covered in greater detail in [Appendix G].


1.17 Additional information

1.17.1 Recorded radar information

Recorded radar information on the aircraft was available from 4 radar sites. Initial analysis consisted of viewing the recorded information as it was shown to the controller on the radar screen from which it was clear that the flight had progressed in a normal manner until secondary surveillance radar (SSR) was lost.

The detailed analysis of the radar information concentrated on the break-up of the aircraft. The Royal Signals and Radar Establishment (RSRE) corrected the radar returns for fixed errors and converted the SSR returns to latitude and longitude so that an accurate time and position for the aircraft could be determined. The last secondary return from the aircraft was recorded at 19.02:46.9 hrs, identifying N739PA at Flight Level 310, and at the next radar return there is no SSR data, only 4 primary returns. It was concluded that the aircraft was, by this time, no longer a single return and, considering the approximately 1 nautical mile spread of returns across track, that items had been ejected at high speed probably to both right and left of the aircraft.

Each rotation of the radar head thereafter showed the number of returns increasing, with those first identified across track having slowed down very quickly and followed a track along the prevailing wind line. The radar evidence then indicated that a further break-up of the aircraft had occurred and formed a parallel wreckage trail to the north of the first. From the absence of any returns travelling along track it was concluded that the main wreckage was travelling almost vertically downwards for much of the time.

A detailed analysis of the recorded radar information, together with the radar, ATC and seismic recordings is contained in Appendix C.

1.17.2 Seismic data

The British Geological Survey has a number of seismic monitoring stations in Southern Scotland. Stations close to Lockerbie recorded a seismic event measuring 1.6 on the Richter scale and, with appropriate corrections for the times of the waves to reach the sensors, it was established that this occurred at 19.03:36.5 hrs ±1 second. A further check was made by triangulation techniques from the information recorded by the various sensors.

An analysis of the seismic recording, together with the radar, ATC and radar information is contained in Appendix C.

1.17.3 Trajectory analysis

A detailed trajectory analysis was carried out by Cranfield Institute of Technology in an effort to provide a sequence for the aircraft disintegration. This analysis comprised several separate processes, including individual trajectory calculations for a limited number of key items of wreckage and mathematical modelling of trajectory paths adopted by a series of hypothetical items of wreckage encompassing the drag/weight spectrum of the actual wreckage.

The work carried out at Cranfield enabled the reasons for the two separate trails to be established. The narrow northern trail was shown to be created by debris released from the aircraft in a vertical dive between 19,000 and 9,000 feet overhead Lockerbie. The southern trail, longer and straight for most of its length, appeared to have been created by wreckage released during the initial disintegration at altitude whilst the aircraft was in level flight. Those items falling closest to Lockerbie would have been those with higher density which would travel a significant distance along track before losing all along-track velocity, whilst only drifting a small distance downwind, owing to the high speed of their descent. The most westerly items thus showed the greatest such effect. The southern trail therefore had curved boundaries at its western end with the curvature becoming progressively less to the east until the wreckage essentially fell in a straight band. Thus wreckage in the southern trail positioned well to the east could be assumed to have retained negligible velocity along aircraft track after separation and the along-track distribution could be used to establish an approximate sequence of initial disintegration.

The analysis calculated impact speeds of 120 kts for the nose section weighing approximately 17,500 lb and 260 kts for the engines and pylons which each weighed about 13,500 lb. Based on the best available data at the time, the analysis showed that the wing (approximately 100,000 lb of structure containing an estimated 200,000 lb of fuel) could have impacted at a speed, in theory, as high as 650 kts if it had 'flown' in a streamlined attitude such that the drag coefficient was minimal. However, because small variations of wing incidence (and various amounts of attached fuselage) could have resulted in significant increases in drag coefficient, the analysis also recognized that the final impact speed of the wing could have been lower.

1.17.4 Space debris re-entry

Four items of space debris were known to have re-entered the Earth's atmosphere on 21 December 1988. Three of these items were fragments of debris which would not have survived re-entry, although their burn up in the upper atmosphere might have been visible from the Earth's surface. The fourth item landed in the USSR at 09.50 hrs UTC.


CLICK HERE TO RETURN TO INDEX
2 ANALYSIS

2.1 Introduction

The airport security and criminal aspects of the destruction of Boeing 747 registration N739PA near Lockerbie on 21 December 1988 are the subjects of a separate investigation and are not covered in this report. This analysis discusses the technical aspects of the disintegration of the aircraft and considers possible ways of mitigating the effects of an explosion in the future.

2.2 Explosive destruction of the aircraft

The geographical position of the final secondary return at 19.02:46.9 hrs was calculated by RSRE to be OS Grid Reference 15257772, annotated Point A in Appendix B, Figure B-4, with an accuracy considered to be better than ±300 metres This return was received 3.1±1 seconds before the loud sound was recorded on the CVR at 19.02:50 hrs. By projecting from this position along the track of 321°(Grid) for 3.1±1 seconds at the groundspeed of 434 kts, the position of the aircraft was calculated to be OS Grid Reference 14827826, annotated Point B in Appendix B, Figure B-4, within an accuracy of ±525 metres. Based on the evidence of recorded data only, Point B therefore represents the geographical position of the aircraft at the moment the loud sound was recorded on the CVR. 

The datum line, discussed at paragraph 1.12.1.6, was derived from a detailed analysis of the distribution of specific items of wreckage, including those exhibiting positive evidence of a detonating high performance plastic explosive. The scatter of these items about the datum line may have been due partly to velocities imparted by the force of the detonating explosive and partly by the difficulty experienced in pinpointing the location of the wreckage accurately in relatively featureless terrain and poor visibility. However, the random nature of the scatter created by these two effects would have tended to counteract one another, and a major error in any one of the eleven grid references would have had little overall effect on the whole line. There is, therefore, good reason to have confidence in the validity of the datum line.

The items used to define the datum line, included those exhibiting positive evidence of a detonating high performance plastic explosive, would have been the first pieces to have been released from the aircraft. The datum line was projected westwards until it intersected the known radar track of the aircraft in order to derive the position of the aircraft along track at which the explosive items were released and therefore the position at which the IED had detonated. This position was OS grid reference 146786 and is annotated Point C in Appendix B, Figure B-4. Point C was well within the circle of accuracy (±525 metres) of the position at which the loud noise was heard on the CVR (Point B). There can, therefore, be no doubt that the loud noise on the CVR was directly associated with the detonation of the IED and that this explosion initiated the disintegration process and directly caused the loss of the aircraft.

2.3 Flight recorders

2.3.1 Digital flight data recordings

A working group of the European Organisation for Civil Aviation Electronics (EUROCAE) was, during the period of the investigation, formulating new standards (Minimum Operational Performance Requirement for Flight Data Recorder Systems, Ref:- ED55) for future generation flight recorders which would have permitted delays between parameter input and recording (buffering) of up to € second. These standards are intended to form the basis of new CAA specifications for flight recorders and may be adopted worldwide.

The analysis of the recording from the DFDR fitted to N739PA, which is detailed in Appendix C, showed that the recorded data simply stopped. Following careful examination and correlation of the various sources of recorded information, it was concluded that this occurred because the electrical power supply to the recorder had been interrupted at 19.02:50 hrs ±1 second. Only 17 bits of data were not recoverable (less that 23 milliseconds) and it was not possible to establish with any certainty if this data was from the accident flight or was old data from a previous recording.

The analysis of the final data recorded on the DFDR was possible because the system did not buffer the incoming data. Some existing recorders use a process whereby data is stored temporarily in a memory device (buffer) before recording. The data within this buffer is lost when power is removed from the recorder and in currently designed recorders this may mean that up to 1.2 seconds of final data contained within the buffer is lost. Due to the necessary processing of the signals prior to input to the recorder, additional delays of up to 300 milliseconds may be introduced. If the accident had occurred when the aircraft was over the sea, it is very probable that the relatively few small items of structure, luggage and clothing showing positive evidence of the detonation of an explosive device would not have been recovered. However, as flight recorders are fitted with underwater location beacons, there is a high probability that they would have been located and recovered. In such an event the final milliseconds of data contained on the DFDR could be vital to the successful determination of the cause of an accident whether due to an explosive device or other catastrophic failure. Whilst it may not be possible to reduce some of the delays external to the recorder, it is possible to reduce any data loss due to buffering of data within the data acquisition unit.

It is, therefore, recommended that manufacturers of existing recorders which use buffering techniques give consideration to making the buffers non-volatile, and hence recoverable after power loss. Although the recommendation on this aspect, made to the EUROCAE working group during the investigation, was incorporated into ED55, it is also recommended that Airworthiness Authorities re-consider the concept of allowing buffered data to be stored in a volatile memory.


CLICK HERE TO RETURN TO INDEX
2.3.2 Cockpit voice recorders

The analysis of the cockpit voice recording, which is detailed in Appendix C, concluded that there were valid signals available to the CVR when it stopped at 19.02:50 hrs ±1 second because the power supply to the recorder was interrupted. It is not clear if the sound at the end of the recording is the result of the explosion or is from the break-up of the aircraft structure. The short period between the beginning of the event and the loss of electrical power suggests that the latter is more likely to be the case. In order to respond to events that result in the almost immediate loss of the aircraft's electrical power supply it was therefore recommended during the investigation that the regulatory authorities consider requiring CVR systems to contain a short duration (i.e. no greater than 1 minute) back-up power supply. 

2.3.3 Detection of explosive occurrences

In the aftermath of the Air India Boeing 747 accident (AI 182) in the North Atlantic on 23 June 1985, RARDE were asked informally by AAIB to examine means of differentiating, by recording violent cabin pressure pulses, between the detonation of an explosive device within the cabin (positive pulse) and a catastrophic structural failure (negative pulse). Following the Lockerbie disaster it was considered that this work should be raised to a formal research project. Therefore, in February 1989, it was recommended that the Department of Transport fund a study to devise methods of recording violent positive and negative pressure pulses, preferably utilising the aircraft's flight recorder systems. This recommendation was accepted.

Preliminary results from the trials indicate that, if a suitable sensor can be developed, its output will need to be recorded in real time and therefore it may require wiring to the CVR installation. This will further strengthen the requirement for battery back up of the CVR electrical power supply.

2.4 IED position within the aircraft

From the detailed examination of the reconstructed luggage containers, discussed at paragraph 1.12.2.4 and in Appendix F, it was evident that the IED had been located within a metal container (serial number AVE 4041 PA), near its aft outboard quarter as shown in Appendix F, Figure F-13. It was also clear that the container was loaded in position 14L of the forward hold which placed the explosive charge approximately 25 inches inboard from the fuselage skin at frame 700. There was no evidence to indicate that there was more than one explosive charge.

2.5 Engine evidence

To produce the fan blade tip rub damage noted on all engines by means of airflow inclined to the axes of the nacelles would have required a marked nose down change of aircraft pitch attitude combined with a roll rate to the left while all of the engines were attached to the wing.

The shingling damage noted on the fan blades of No 2 engine can only be attributed to airflow disturbance caused by ingestion related fan blade damage occurring when substantial power was being delivered. This is readily explained by the fact that No 2 engine intake is positioned some 27 feet aft and 30 feet outboard of the site of the explosion and that the interior of the intake exhibited a number of prominent paint smears and general foreign object damage. This damage included evidence of a strike by a cable similar to that forming part of the closure curtain of a typical baggage container. It is inconceivable that an independent blade failure could have occurred in the short time frame of this event. By similar reasoning, the absence of such shingling damage on blades of No 3 engine was a reliable indication that it suffered no ingestion until well into the accident sequence.

The combination of the position of the explosive device and the forward speed of the aircraft was such that significant sized debris resulting from the explosion would have been available to be ingested by No 2 engine within milliseconds of the explosion. In view of the fact that the tip rub damage observed on the fan case of No 2 engine is of similar magnitude to that observed on the other three engines it is reasonable to deduce that a manoeuvre of the aircraft occurred before most of the energy of the No 2 engine fan was lost due to the effect of ingestion (seen only in this engine). Since this shingling effect could only readily be produced as a by-product of ingestion whilst delivering considerable power, it is reasonable to assume that this was also occurring before loss of major fan energy due to tip rubbing took place. Hence both phenomena must have been occurring simultaneously, or nearly so, to produce the effects observed and must have occupied a time frame of substantially less than 5 seconds. The onset of this time period would have been the time at which debris from the explosion first inflicted damage to fan blades in No 3 engine and, since the fan is only approximately 40 feet from the location of the explosive device, this would have been an insignificant time interval after the explosion.

It was therefore concluded from this evidence that the wing with all of the engines attached had achieved a marked nose down and left roll attitude change well within 5 seconds of the explosion. 

2.6 Detachment of forward fuselage 

Examination of the three major structural elements either side of the region of station 800 on the right side of the fuselage makes it clear that to produce the curvature of the window belt and peeling of the riveted joint at the R2 door aperture requires the door pillar to be securely in position and able to react longitudinal and lateral loads. This in turn requires the large section of fuselage on the right side between stations 760 and 1000 (incorporating the right half of the floor) to be in position in order to locate the lower end of the door pillar. Thus both these sections must have been in position until the section from station 560 to 800 (right side) had completed its deflection to the right and peeled from the door pillar. Separation of the forward fuselage must thus have been complete by the time all three items mentioned above had fallen free.


CLICK HERE TO RETURN TO INDEX
2.7 Speed of initial disintegration

The distribution of wreckage in the bands between the datum line and the 250, 300, 600 and 900 metre lines was examined in detail. The positions of these items of structure on the aircraft are shown in Appendix B, Figures B-10 to B-13. It should be noted that the position on the ground of these items, although separated by small distances when measured in a direction along aircraft track, were distributed over large distances when measured along the wreckage trail. All were recovered from positions far enough to the east to be in that part of the southern trail which was sufficiently close, theoretically, to a straight line for any curvature effect to be neglected.

The wreckage found in each of the bands enabled an approximate sequence of break-up to be established. It was clear that as the distance travelled from the datum line increased, items of wreckage further from the station of the IED were encountered. The items shown on the diagram as falling on the 250 metre band also include those fragments of lower forward fuselage skin having evidence of explosive damage and presumed to have separated as a direct result of the blast. However, a few portions of the upper forward fuselage were also found within the 250 metre band, suggesting that these items had also separated as a result of the blast. 

By the time the 300 metre line was reached much of the structure from the right side in the region of the explosive device had been shed. This included the area of window belt, referred to in paragraph 2.6 above, which gave clear indications that the forward structure had detached to the right and finally peeled away at station 800. It also included the areas of adjacent structure immediately to the rear of station 800 about which the forward structure would have had to pivot. By the time the 600 metre line was reached, there was clearly insufficient structure left to connect the forward fuselage with the remainder of the aircraft. Wreckage between the 600 and 900 metre lines consisted of structure still further from the site of the IED.

There is evidence that a manoeuvre occurred at the time of the explosion which would have produced a significant change of the aircraft's flight path, however, it is considered that the change in the horizontal velocity component in the first few seconds would not have been great. The original groundspeed of the aircraft was therefore used in conjunction with the distribution of wreckage in the successive bands to establish an approximate time sequence of break-up of the forward fuselage. Assuming the original ground speed of 434 Kts, the elapsed flight times from the datum to each of the parellel lines were calculated to be:

Distance (metres) 250 300 600 900
Time (seconds) 1.1 1.3 2.7 4.0

Thus, there is little doubt that separation of the forward fuselage was complete within 2 to 3 seconds of the explosion. 

The separate assessment of the known grid references of tailplane and elevator wreckage in the southern trail revealed that those items were evenly distributed about the 600 metre line and therefore that most of the tailplane damage occurred after separation of the forward fuselage was complete.

2.8 The manoeuvre following the explosion 

The engine evidence, timing and mode of disintegration of the fuselage and tailplane suggests that the latter did not sustain significant damage until the forward fuselage disintegration was well advanced and the pitch/roll manoeuvre was also well under way.

Examination of the three dimensional reconstruction makes it clear that both main and upper deck floors were disrupted by the explosion. Since pitch control cables are routed through the upper deck floor beams and the roll control cables through the main deck beams, there is a strong possibility that movement of the beams under explosive forces would have applied inputs to the control cables, thus operating control surfaces in both axes.

2.9 Secondary disintegration

The distribution of fin debris between the trails suggests that disintegration of the fin began shortly before the vertical descent was established. No single mode of failure was identified and the debris which had struck the leading edge had not caused major disruption. The considerable fragmentation of the thick panels of the aft torque box was also very different from that noted on the corresponding structure of the tailplanes. It was therefore concluded that the mode of failure was probably flutter.

The finding, in the northern trail, of a slide raft wrapped around a flap track fairing suggests that at a later stage of the disintegration the rear of the aircraft must have experienced a large angle of sideslip. The loss of the fin would have made this possible and also subjected the structure to large side loads. It is possible that such side loading would have assisted the disintegration of the rear fuselage and also have caused bending failure of the pylon attachments of the remaining three engines.

2.10 Impact speed of components

The trajectory analysis carried out by Cranfield Institute of Technology calculated impact speeds of 120 kts for the nose section, and 260 kts for the engines and pylons. These values were considered to be reliable because the drag coefficients could be estimated with a reasonable degree of confidence. Based on the best available data at the time, the analysis also showed that the wing could have impacted at a speed, in theory, as high as 650 kts if it had flown in a streamlined attitude such that the drag coefficient was minimal. However, it was also recognized that relatively small changes in the angle of incidence of the wing would have produced a significant increase in drag with a consequent reduction in impact speed. Refinement of timing information and radar data subsequent to the Cranfield analysis has enabled a revised estimate to be made of the mean speed of the wing during the descent.

The engine evidence indicated that there had been a large nose down attitude change of the aircraft early in the event. The Cranfield analysis also showed that the rear fuselage had disintegrated while essentially in a vertical descent between 19,000 and 9,000 feet over Lockerbie. Assuming that, following the explosion, the wing followed a straight line descending flight profile from 31,000 feet to 19,000 feet directly overhead Lockerbie and then descended vertically until impact, the wing would have travelled the minimum distance practicable. The ground distance between the geographical position at which the disintegration started (Figure B-4, Point B) and the crater made by the wing impact was 2997 ±525 metres (9833 ±1722 feet). The time interval between the explosion and the wing impact was established in Appendix C as 46.5 ±2 seconds. Based on the above times and distances the mean linear speed achieved by the wing would have been about 440 kts.

The impact location of Nos 1, 2, and 4 engines closely grouped in Lockerbie was consistent with their nearly vertical fall from a point above the town. If they had separated at about 19,000 feet and the wing had then flown as much as one mile away from the overhead position before tracking back to impact, the total flight path length of the wing would not have required it to have achieved a mean linear speed in excess of 500 kts.

Any speculation that the flight path of the wing could have been longer would have required it to have undergone manoeuvres at high speed in order to arrive at the 19,000 feet point. The manoeuvres involved would almost certainly have resulted in failure of the primary wing structure which, from distribution of wing debris, clearly did not occur. Alternatively the wing could have travelled more than one mile from Lockerbie after reaching the 19,000 feet point, but this was considered unlikely. It is therefore concluded that the mean speed of the wing during the descent was in the region of 440 to 500 kts.

2.11 Sequence of disintegration

Analysis of wreckage in each of the bands, taken in conjunction with the engine evidence and the three-dimensional reconstruction, suggests the following sequence of disintegration:


(i) The initial explosion triggered a sequence of events which effectively destroyed the structural integrity of the forward fuselage. Little more then remained between stations 560 and 760 (approximately) than the window belts and the cabin sidewall structure immediately above and below the windows, although much of the cargo-hold floor structure appears to have remained briefly attached to the aircraft. [Appendix B, Figure B-24] 
(ii) The main portion of the aircraft simultaneously entered a manoeuvre involving a marked nose down and left roll attitude change, probably as a result of inputs applied to the flying control cables by movement of structure. 
(iii) Failure of the left window belt then occurred, probably in the region of station 710, as a result of torsional and bending loads on the fuselage imparted by the manoeuvre (i.e. the movement of the forward fuselage relative to the remainder of the aircraft was an initial twisting motion to the right, accompanied by a nose up pitching deflection). 
(iv) The forward fuselage deflected to the right, pivoting about the starboard window belt, and then peeled away from the structure at station 800. During this process the lower nose section struck the No 3 engine intake causing the engine to detach from its pylon. This fuselage separation was apparently complete within 3 seconds of the explosion. 
(v) Structure and contents of the forward fuselage struck the tail surfaces contributing to the destruction of the outboard starboard tailplane and causing substantial damage to the port unit. This damage occurred approximately 600 metres track distance after the explosion and therefore appears to have happened after the fuselage separation was complete. 
(vi) Fuselage structure continued to break away from the aircraft and the separated forward fuselage section as they descended. 
(vii) The aircraft maintained a steepening descent path until it reached the vertical in the region of 19,000 feet approximately over the final impact point. Shortly before it did so the tail fin began to disintegrate. 
(viii) The mode of failure of the fin is not clear, however, flutter of its structure is suspected. 
(ix) Once established in the vertical dive, the fin torque box continued to disintegrate, possibly permitting the remainder of the aircraft to yaw sufficiently to cause side load separation of Nos 1, 2 and 4 engines, complete with their pylons. 
(x) Break-up of the rear fuselage occurred during the vertical descent, possibly as a result of loads induced by the yaw, leaving a section of cabin floor and baggage hold from approximately stations 1241 to 1920, together with 3 landing gear units, to fall into housing at Rosebank Terrace. 
(xi) The main wing structure struck the ground with a high yaw angle at Sherwood Crescent. 
CLICK HERE TO RETURN TO INDEX
2.12 Explosive mechanisms and the structural disintegration 

The fracture and damage pattern analysis was mainly of an interpretive nature involving interlocking pieces of subtle evidence such as paint smears, fracture and rivet failure characteristics, and other complex features. In the interests of brevity, this analysis will not discuss the detailed interpretation of individual fractures or damage features. Instead, the broader 'damage picture' which emerged from the detailed work will be discussed in the context of the explosive mechanisms which might have produced the damage, with a view to identifying those features of greatest significance. 

It is important to keep in mind that whilst the processes involved are considered and discussed separately, the timescales associated with shock wave propagation and the high velocity gas flows are very short compared with the structural response timescales. Consequently, material which was shattered or broken by the explosive forces would have remained in place for a sufficiently long time that the structure can be considered to have been intact throughout much of the period that these explosive propagation phenomena were taking place.

2.12.1 Direct blast effect

2.12.1.1 Shock wave propagation

The direct effect of the explosive detonation within the container was to produce a high intensity spherically propagating shock wave which expanded from the centre of detonation close to the side of the container, shattering part of the side and base of the container as it passed through into the gap between the container and the fuselage skin. In breaking out of the container, some internal reflection and Mach stem interaction would have occurred, but this would have been limited by the absorptive effect of the baggage inboard, above, and forward of the charge. The force of the explosion breaking out of the container would therefore have been directed downwards and rearwards.

The heavy container base was distorted and torn downwards, causing buckling of the adjoining section of frame 700, and the container sides were blasted through and torn, particularly in the aft lower corner. Some of the material in the direct path of the explosive pressure front was reduced to shrapnel sized pieces which were rapidly accelerated outwards behind the primary shock front. Because of the overhang of the container's sloping side, fragments from both the device itself and the container wall impacted the projecting external flange of the container base edge member, producing micro cratering and sooting. Metallurgical examination of the internal surfaces of these craters identified areas of melting and other features which were consistent only with the impact of very high energy particles produced by an explosion at close quarters. Analysis of material on the crater surfaces confirmed the presence of several elements and compounds foreign to the composition of the edge member, including material consistent with the composition of the sheet aluminium forming the sloping face of the container. 

On reaching the inner surface of the fuselage skin, the incident shock wave energy would partially have been absorbed in shattering, deforming and accelerating the skin and stringer material in its path. Much of its energy would have been transmitted, as a shock wave, through the skin and into the atmosphere [Appendix B, Figure B-25], but a significant amount of energy would have been returned as a reflected shock wave, back into the cavity between the container and the fuselage skin where Mach stem shock waves would have been formed. Evidence of rapid shattering was found in a region approximately bounded by frames 700 & 720 and stringers 38L & 40L, together with the lap joint at 39L.

The shattered fuselage skin would have taken a significant time to move, relative to the timescales associated with the primary shock wave propagation. Clear evidence of soot and small impact craters were apparent on the internal surfaces of all fragments of container and structure from the shatter zone, confirming that the this material had not had time to move before it was hit by the cloud of shrapnel, unburnt explosive residues and sooty combustion products generated at the seat of the explosion.

Following immediately behind the primary shock wave, a secondary high pressure wave - partly caused by reflections off the baggage behind the explosive material but mainly by the general pressure rise caused by the chemical conversion of solid explosive material to high temperature gas - emerged from the container. The effect of this second pressure front, which would have been more sustained and spread over a much larger area, was to cause the fuselage skin to stretch and blister outwards before bursting and petalling back in a star-burst pattern, with rapidly running tear fractures propagating away from a focus at the shatter zone. The release of stored energy as the skin ruptured, combined with the outflow of high pressure gas through the aperture, produced a characteristic curling of the skin 'petals' - even against the slipstream. For the most part, the skins which petalled back in this manner were torn from the frames and stringers, but the frames and stringers themselves were also fractured and became separated from the rest of the structure, producing a very large jagged hole some 5 feet longitudinally by 17 feet circumferentially (upwards to a region just below the window belt and downwards virtually to the centre line).

From this large jagged hole, three of the fractures continued to propagate away from the hole instead of terminating at the boundary. One fracture propagated longitudinally rearwards as far as the wing cut-out and another forwards to station 480, creating a continuous longitudinal fracture some 43 feet in length. A third fracture propagated circumferentially downwards along frame 740, under the belly, and up the right side of the fuselage almost as far as the window belt - a distance of approximately 23 feet. 

These extended fractures all involved tearing or related failure modes, sometimes exploiting rivet lines and tearing from rivet hole to rivet hole, in other areas tearing along the full skin section adjacent to rivet lines, but separate from them. Although the fractures had, in part, followed lap joints, the actual failure modes indicated that the joints themselves were not inherently weak, either as design features or in respect of corrosion or the conditions of the joints on this particular aircraft.

Note: The cold bond process carried out at manufacture on the lap joints had areas of disbonding prior to the accident. This disbonding is a known feature of early Boeing 747 aircraft which, by itself, does not detract from the structural integrity of the hull. The cold bond adhesive was used to improve the distribution of shear load across the joint, thus reducing shear transfer via the fasteners and improving the resistance of the joint to fatigue damage; the fasteners were designed to carry the full static loading requirements of the joint without any contribution from the adhesive. Thus, the loss of the cold bond integrity would only have been significant if it had resulted in the growth of fatigue cracks, or corrosion induced weaknesses, which had then been exploited by the explosive forces. No evidence of fatigue cracking was found in the bonded joints. Inter-surface corrosion was present on most lap joints but only one very small region of corrosion had resulted in significant material thinning; this was remote from the critical region and had not played any part in the break-up. 

The cracks propagating upwards as part of the petalling process did not extend beyond the window line. The wreckage evidence suggests that the vertical fractures merged, effectively closing off the fracture path to produce a relatively clean bounding edge to the upper section of the otherwise jagged hole produced by the petalling process. There are at least two probable reasons for this. Firstly the petalling fractures above the shattered zone did not diverge, as they had tended to do elsewhere. Instead, it appears that a large skin panel separated and peeled upwards very rapidly producing tears at each side which ran upwards following almost parallel paths. However, there are indications that by the time the fractures had run several feet, the velocity of fracture had slowed sufficiently to allow the free (forward) edge of the skin panel to overtake the fracture fronts, as it flexed upwards, and forcibly strike the fuselage skin above, producing clear witness marks on both items. Such a tearing process, in which an approximately rectangular flap of skin is pulled upwards away from the main skin panel, is likely to result in the fractures merging. Secondly, this merging tendency would have been reinforced in this particular instance by the stiff window belt ahead of the fractures, which would have tended to turn the fractures towards the horizontal. 

It appears that the presence of this initial ('clean') hole, together with the stiff window belt above, encouraged other more slowly running tears to break into it, rather than propagating outwards away from the main hole.

2.12.1.2 Critical crack considerations

The three very large tears extending beyond the boundary of the petalled region resulted in a critical reduction of fuselage structural integrity.

Calculations were carried out at the Royal Aerospace Establishment to determine whether these fractures, growing outwards from the boundary of the petalled hole, could have occurred purely as a result of normal differential pressure loading of the fuselage, or whether explosive forces were required in addition to the pressurisation loads.

Preliminary calculations of critical crack dimensions for a fuselage skin punctured by a 20 by 20 inches jagged hole indicated that unstable crack growth would not have occurred unless the skin stress had been substantially greater than the stress level due to normal pressurisation loads alone. It was therefore clear that explosive overpressure must have produced the gross enlargement of the initially small shattered hole in the hull. Furthermore, it was apparent from the degree of curling and petalling of the skin panels within the star-burst region that this overpressure had been relatively long term, compared with the shock wave overpressure which had produced the shatter zone. A more refined analysis of critical crack growth parameters was therefore carried out in which it was assumed that the long term explosive overpressure was produced by the chemical conversion of solid explosive material into high temperature gas.

An outline of the fracture propagation analysis is given at Appendix D. This analysis, using theoretical fracture mechanics, showed that, after the incident shock wave had produced the shatter zone, significant explosive overpressure loads were needed to drive the star-burst fractures out to the boundary of the petalled skin zone. Thereafter, residual gas overpressure combined with fuselage pressurisation loads were sufficient to produce the two major longitudinal cracks and a single major circumferential crack, extending from the window belt down to beyond the keel centreline. 

2.12.1.3 Damage to the cabin floor structure

The floor beams in the region immediately above the baggage container in which the explosive had detonated were extensively broken, displaying clear indications of overload failure due to buckling caused by localised upward loading of the floor structure.

No direct evidence of bruising was found on the top panel of the container. It therefore appears that the container did not itself impact the floor beams, but instead the floor immediately above the container was broken through as a result of explosive overpressure as gases emerged from the ruptured container and loaded the floor panels. Data on floor strengths, provided by Boeing, indicated that the cabin floor (with the CRAF modification) would fail at a uniform static differential pressure of between 3.5 and 3.9 psi (high pressure below the cabin floor), and that the floor panel to floor beam attachments would not fail before the floor beams. Whilst there is no direct evidence of the pressure loading on the floor structure immediately following detonation, there can be no doubt that in the region of station 700 it would have exceeded the ultimate failure load by a large margin.

2.12.2 Indirect explosive damage (damage at remote sites)

All of the damage considered in the foregoing analysis, and the mechanisms giving rise to that damage, resulted from the direct impact of explosive shock waves and/or the short-term explosive overpressure on structure close to the source of the explosion. However, there were several regions of skin separation at sites remote from the explosion (see para 1.12.3.2) which were much more difficult to understand. These remote sites formed islands of indirect explosive damage separated from the direct damage by a sea of more generalised structural failure characterised by the progressive aerodynamic break-up of the weakened forward fuselage. All of these remote damage sites were consistent with the impact of very localised pressure impulses on the internal surfaces of the hull -effectively high energy 'pressure blows' against the inner surfaces produced by explosive shock waves and/or high pressure gas flows travelling through the interior spaces of the hull.

The propagation of explosive shock waves and supersonic gas flows within multiple, interlinking, cavities having indeterminate energy absorption and reflection properties, and ill-defined structural response, is extremely complex. Work has been initiated in an attempt to produce a three-dimensional computer analysis of the shock wave and supersonic flow propagation inside the fuselage, but full theoretical analysis is beyond present resources.

Because of the complexity of the problem, the following analysis will be restricted to a qualitative consideration of the processes which were likely to have taken place. Whilst such an approach is necessarily limited, it has identified a number of propagation mechanisms which appear to have been of fundamental importance to the break-up of Flight PA103, and which are likely to be critical in any future incident involving the detonation of high explosive inside an aircraft hull.

2.12.2.1 Shock wave propagation through internal cavities

When Mach stem shocks are produced not only are the shock pressures very high but they propagate at very high velocity parallel to the reflecting surface. In the context of the lower fuselage structure in the region of Mach stem formation, it can readily be seen that the Mach stem will be perfectly orientated to enter the narrow cavity formed between the outer skin and the cargo liner/containers, bounded by the fuselage frames [Appendix B, Figure B-25]. This cavity enables the Mach stem shock wave to propagate, without causing damage to the walls (due to the relatively low pressure where the Mach stem sweeps their surface), and reach regions of the fuselage remote from the source of the explosion. Furthermore, energy losses in the cavity are likely to be less than would occur in the 'free' propagation case, resulting in the efficient transmission of explosive energy. The cavity would tend to act like a 'shock tube', used for high speed aerodynamic research, confining the shock wave and keeping it running along the cavity axis, with losses being limited to kinetic heating due to friction at the walls.

Paragraph 1.6.3 contains a general description of the structural arrangements in the area of the cargo hold. Before proceeding further and considering how the shock waves might have propagated through this network of cavities, it should be pointed out that the timescale associated with the propagation of the shock waves is very short compared with the timescale associated with physical movement and separation of skin and structure fractured or damaged by the shock. Therefore, for the purpose of assessing the shock propagation through the cavities, the explosive damage to the hull can be ignored and the structure regarded as being intact. A further simplification can usefully be made by considering the structure to be rigid. This assumption would, if the analysis were quantitative, result in over-estimations of the shock strengths. However, for the purposes of a purely qualitative assessment, the assumption should be valid, in that the general trends of behaviour should not be materially altered.

It has already been argued that the shock wave emerging from the container was, in part, reflected back off the inner surface of the fuselage skin, forming a Mach stem shock wave which would then have tended to travel into the semi-circular lower lobe cavity. The Mach stem waves would have propagated away through this cavity in two directions:


(i) under the belly, between the frames [Appendix B, Figure B-3, detail A], and 
(ii) up the left side, expanding into the cavity formed by the longitudinal manifold chamber where it joins the lower lobe cavity. 
As the shock waves travelled along the cavity, little attenuation or other change of characteristic was likely to have occurred until the shocks passed the entrances to other cavities, or impinged upon projections and other local changes in the cavity. A review of the literature dealing with propagation of blast waves within such cavities provides useful insights into some of the physical mechanisms involved.

As part of a research program carried out into the design of ventilation systems for blast hardened installations intended to survive the long duration blast waves following the detonation of nuclear weapons, the propagation of blast waves along the primary passages and into the side branches of ventilation ducts was studied. The research showed that 90° bends in the ducts produced very little attenuation of shock wave pressure; a series of six right angle bends produced only a 30% pressure attenuation, together with an extension of the shock duration. It is therefore evident that the attenuation of shock waves propagating through the fuselage cavities, all of which were short with hardly any right angle turns, would have been minimal.

It was also demonstrated that secondary shock waves develop within the entrance to any side branch from the main duct, produced by the interaction of the primary shock wave with the geometric changes in the duct walls at the side-branch location. These secondary shock waves interact as they propagate into the side branch, combining together within a relatively short distance (typically 7 diameters) to produce a single, plane shock wave travelling along the duct axis. In a rigid, smooth walled structure, this mechanism produces secondary shock overpressures in the side branch of between 30% and 50% of the value of the primary shock, together with a corresponding attenuation of the primary shock wave pressure by approximately 20% to 25%.

This potential for the splitting up and re-transmission of shock wave energy within the lower hull cavities is of extreme importance in the context of this accident. Though the precise form of the interactions is too complex to predict quantitatively, it is evident that the lower hull cavities will serve to convey the overpressure efficiently to other parts of the aircraft. Furthermore, the cavities are not of serial form, i.e. they do not simply branch (and branch again) in a divergent manner, but instead form a parallel network of short cavities which reconnect with each other at many different points, principally along the crease beams. Thus, considerable scope exists for: the additive recombination of blast waves at cavity junctions; for the sustaining of the shock overpressure over a greater time period; and, for the generation of multiple shocks produced by the delay in shock propagation inherent in the different shock path (i.e. cavity) lengths.

Whilst it has not been possible to find a specific mechanism to explain the regions of localised skin separation and peel-back (i.e. the 'pressure blow' regions referred to in para 2.12.2), they were almost certainly the result of high intensity shock overpressures produced locally in those regions as a result of the additive recombination of shock waves transmitted through the lower hull cavities. It is considered that the relatively close proximity of the left side region of damage just below floor level at station 500, [Appendix B, Figure B-19, region D] to the forward end of the cargo hold may be significant insofar as the reflections back from the forward end of the hold would have produced a local enhancement of the shock overpressure. Similarly, 'end blockage effects' produced by the cargo door frame might have been responsible for local enhancements in the area of the belly skin separation and curl-back at station 560 [Appendix B, Figure B-19 and B-20, region E].

The separation of the large section of upper fuselage skin [Appendix B, Figure B-19 and B-20, detail B] was almost certainly associated with a local overpressure in the side cavities between the main deck window line and the upper deck floor, where the cavity is effectively closed off. It is considered that the most probable mechanism producing this region of impulse overpressure was a reflection from the closed end of the cavity, possibly combined with further secondary reflections from the window assembly, the whole being driven by reflective overpressures at the forward end of the longitudinal manifold cavity caused by the forward end of the cargo hold. The local overpressure inside the sidewall cavity would have been backed up by a general cabin overpressure resulting from the floor breakthrough, giving rise to an increased pressure acting on the inner face of the cabin side liner panels. This would have provided pseudo mass to the panels, effectively preventing them from moving inwards and allowing them to react the impulse pressure within the cavity, producing the region of local high pressure evidenced by the region of quilting on the skin panels [Appendix B, Figure B-19, region C].


CLICK HERE TO RETURN TO INDEX
2.12.2.2 Propagation of shock waves into the cabin

The design of the air-conditioning/depressurisation-venting systems on the Boeing 747 (and on most other commercial aircraft) is seen as a significant factor in the transmission of explosive energy, as it provides a direct connection between the main passenger cabin and the lower hull at the confluence of the lower hull cavities below the crease beam. The floor level air conditioning vents along the length of the cabin provided a series of apertures through which explosive shock waves, propagating through the sub floor cavities, would have radiated into the main cabin.

Once the shock waves entered the cabin space, the form of propagation would have been significantly different from that which occurred in the cavities in the lower hull. Again, the precise form of such radiation cannot be predicted, but it is clear that the energy would potentially have been high and there would also (potentially) have been a large number of shock waves radiating into the cabin, both from individual vents and in total, with further potential to recombine additively or to 'follow one another up' producing, in effect, sustained shock overpressures.

Within the cabin, the presence of hard, reflective, surfaces are likely to have been significant. Again, the precise way in which the shock waves interacted is vastly beyond the scope of current analytical methods and computing power, but there clearly was considerable potential for additive recombination of the many different shock waves entering at different points along the cabin and the reflected shock waves off hard surfaces in the cabin space, such as the toilet and galley compartments and overhead lockers. These recombination effects, though not understood, are known phenomena. Appendix B, Figure B-26 shows how shock waves radiating from floor level might have been reflected in such a way as produce shock loading on a localised area of the pressure hull.

2.12.2.3 Supersonic gas flows

The gas produced by the explosive would have resulted in a supersonic flow of very high pressure gas through the structural cavities, which would have followed up closely behind the shock waves. Whilst the physical mechanisms of propagation would have been different from those of the shock wave, the end result would have been similar, i.e. there would have been propagation via multiple, linked paths, with potential for additive recombination and successive pressure pulses resulting from differing path lengths. Essentially, the shock waves are likely to have delivered initial 'pressure blows' which would then have been followed up immediately by more sustained pressures resulting from the high pressure supersonic gas flows. 

2.13 Potential limitation of explosive damage 

Quite clearly the detonation of high explosive material anywhere on board an aircraft is potentially catastrophic and the most effective means of protecting lives is to stop such material entering the aircraft in the first place. However, it is recognised that such risks cannot be eliminated entirely and it is therefore essential that means are sought to reduce the vulnerability of commercial aircraft structures to explosive damage.

The processes which take place when an explosive detonates inside an aircraft fuselage are complex and, to a large extent, fickle in terms of the precise manner in which the processes occur. Furthermore, the potential variation in charge size, position within the hull, and the nature of the materials in the immediate vicinity of the charge (baggage etc) are such that it would be unrealistic to expect to neutralise successfully the effect of every potential explosive device likely to be placed on board an aircraft. However, whilst the problem is intractable so far as a total solution is concerned, it should be possible to limit the damage caused by an explosive device inside a baggage container on a Boeing 747 or similar aircraft to a degree which would allow the aircraft to land successfully, albeit with severe local damage and perhaps resulting in some loss of life or injuries.

In Appendix E the problem of reducing the vulnerability of commercial aircraft to explosive damage is discussed, both in general terms and in the context of aircraft of similar size and form to the Boeing 747. In that discussion, those damage mechanisms which appear to have contributed to the catastrophic structural failure of Flight PA103 are identified and possible ways of reducing their damaging effects are suggested. These suggestions are intended to stimulate thought and discussion by manufacturers, airworthiness authorities, and others having an interest in finding solutions to the problem; they are intended to serve as a catalyst rather than to lay claim to a definitive solution.



CLICK HERE TO RETURN TO INDEX
2.14 Summary

It was established that the detonation of an IED, loaded in a luggage container positioned on the left side of the forward cargo hold, directly caused the loss of the aircraft. The direct explosive forces produced a large hole in the fuselage structure and disrupted the main cabin floor. Major cracks continued to propagate from the large hole under the influence of the service pressure differential. The indirect explosive effects produced significant structural damage in areas remote from the site of the explosion. The combined effect of the direct and indirect explosive forces was to destroy the structural integrity of the forward fuselage, allow the nose and flight deck area to detach within a period of 2 to 3 seconds, and subsequently allow most of the remaining aircraft to disintegrate while it was descending nearly vertically from 19,000 to 9,000 feet.

The investigation has enabled a better understanding to be gained of the explosive processes involved in such an event and to suggest ways in which the effects of such an explosion might be mitigated, both by changes to future design and also by retrospective modification of aircraft. It is therefore recommended that Regulatory Authorities and aircraft manufacturers undertake a systematic study with a view to identifying measures that might mitigate the effects of explosive devices and improve the tolerance of the aircraft structure and systems to explosive damage.


3. CONCLUSIONS


(a) Findings 
(i) The crew were properly licenced and medically fit to conduct the flight. 
(ii) The aircraft had a valid Certificate of Airworthiness and had been maintained in compliance with the regulations. 
(iii) There was no evidence of any defect or malfunction in the aircraft that could have caused or contributed to the accident. 
(iv) The structure was in good condition and the minimal areas of corrosion did not contribute to the in-flight disintegration. 
(v) One minor fatigue crack approximately 3 inches long was found in the fuselage skin but this had not been exploited during the disintegration. 
(vi) An improvised explosive device detonated in luggage container serial number AVE 4041 PA which had been loaded at position 14L in the forward hold. This placed the device approximately 25 inches inboard from the skin on the lower left side of the fuselage at station 700. 
(vii) The analysis of the flight recorders, using currently accepted techniques, did not reveal positive evidence of an explosive event. 
(viii) The direct explosive forces produced a large hole in the fuselage structure and disrupted the main cabin floor. Major cracks continued to propagate from the large hole under the influence of the service pressure differential. 
(ix) The indirect explosive effects produced significant structural damage in areas remote from the site of the explosion. 
(x) The combined effect of the direct and indirect explosive forces was to destroy the structural integrity of the forward fuselage. 
(xi) Containers and items of cargo ejected from the fuselage aperture in the forward hold, together with pieces of detached structure, collided with the empennage severing most of the left tailplane, disrupting the outer half of the right tailplane, and damaging the fin leading edge structure. 
(xii) The forward fuselage and flight deck area separated from the remaining structure within a period of 2 to 3 seconds. 
(xiii) The No 3 engine detached when it was hit by the separating forward fuselage. 
(xiv) Most of the remaining aircraft disintegrated while it was descending nearly vertically from 19,000 to 9,000 feet. 
(xv) The wing impacted in the town of Lockerbie producing a large crater and creating a fireball. 

(b) Cause

The in-flight disintegration of the aircraft was caused by the detonation of an improvised explosive device located in a baggage container positioned on the left side of the forward cargo hold at aircraft station 700.


CLICK HERE TO RETURN TO INDEX
4. SAFETY RECOMMENDATIONS 

The following Safety Recommendations were made during the course of the investigation :


4.1 That manufacturers of existing recorders which use buffering techniques give consideration to making the buffers non-volatile, and the data recoverable after power loss. 
4.2 That Airworthiness Authorities re-consider the concept of allowing buffered data to be stored in a volatile memory. 
4.3 That Airworthiness Authorities consider requiring the CVR system to contain a short duration, i.e. no greater than 1 minute, back-up power supply to enable the CVR to respond to events that result in the almost immediate loss of the aircraft's electrical power supply. 
4.4 That the Department of Transport fund a study to devise methods of recording violent positive and negative pressure pulses, preferably utilising the aircraft's flight recorder systems. 
4.5 That Airworthiness Authorities and aircraft manufacturers undertake a systematic study with a view to identifying measures that might mitigate the effects of explosive devices and improve the tolerance of aircraft structure and systems to explosive damage. 

M M Charles
Inspector of Accidents
Department of Transport

July 1990 
CLICK HERE TO RETURN TO INDEX


APPENDIX A

PERSONNEL CONDUCTING THE INVESTIGATION

The following Inspectors of the Air Accidents Investigation Branch conducted the investigation:
 Mr M M Charles
                                              Investigator-in-Charge 
 Mr D F King
                                              Principal Inspector (Engineering) 
 Mr P F Sheppard
                                              Assistant Principal Inspector (Engineering) 
 Mr A N Cable
                                              Senior Inspector (Engineering) 
 Mr R G Carter
                                              Senior Inspector (Engineering) 
 Mr P T Claiden
                                              Senior Inspector (Engineering) 
 Mr P R Coombs
                                              Senior Inspector (Engineering) 
 Mr S R Culling
                                              Senior Inspector (Engineering) 
 Miss A Evans
                                              Senior Inspector (Engineering) 
 Mr B M E Forward
                                              Senior Inspector (Operations) 
 Mr P N Giles
                                              Senior Inspector (Operations) 
 Mr S W Moss
                                              Senior Inspector (Engineering) 
 Mr R Parkinson
                                              Senior Inspector (Engineering) 
 Mr J D Payling
                                              Senior Inspector (Operations) 
 Mr C G Pollard
                                              Senior Inspector (Engineering) 
 Mr C A Protheroe
                                              Senior Inspector (Engineering) 
 Mr A H Robinson
                                              Senior Inspector (Engineering) 
 Mr A P Simmons
                                              Senior Inspector (Engineering) 
 Mr R G Vance
                                              Senior Inspector (Engineering) 
 Mr R StJ Whidborne
                                              Senior Inspector (Operations) 


The Air Accidents Investigation Branch would like to thank the following organisations from the United Kingdom, United States of America, France, and Canada who participated in the investigation: 

Air Line Pilot's Association International 

Boeing Commercial Airplane Company 

British Airways 

British Army 

British Geological Survey 

Bureau Enquete Accidents 

Canadian Aviation Safety Bureau 

Civil Aviation Authority 

Cranfield Institute of Technology 

Federal Aviation Administration 

Federal Bureau of Investigation 

Independent Union of Flight Attendants 

National Transportation Safety Board 

Pan American World Airways 

Police Service 

Royal Aerospace Establishment 

Royal Air Force 

Royal Armaments Research and Development Establishment 

Royal Navy 

Royal Ordnance 

Royal Signals and Radar Establishment 

United Technologies International Operations (Pratt and Whitney) 

The Air Accidents Investigation Branch would also like to acknowledge the excellent work of the Dumfries & Galloway Regional Council and to thank all the many voluntary organisations who gave such
unstinting support to the investigation. 

APPENDIX C


ANALYSIS OF RECORDED DATA

1. Introduction

This appendix describes and analyses the different types of recorded data which were examined during the investigation of the accident to Boeing 747 registration N739PA at Lockerbie on 21 December 1988.
The recorded data consists of that from the Cockpit Voice Recorder (CVR), the Digital Flight Data Recorder (DFDR), Air Traffic Control (ATC) radio telephony (RTF), ATC radar, and British Geological
Survey seismic records. The time correlation of the records is also discussed.

2. Digital flight data recorder

The flight data recorder installation conformed to ARINC 573B standard with a Lockheed Model 209 DFDR receiving data from a Teledyne Controls Flight Data Acquisition Unit (FDAU). The system
recorded 22 analogue parameters and 27 discrete (event) parameters. The flight recorder control panel was located in the flight deck overhead panel. The FDAU was in the main equipment centre at the front
end of the forward hold and the flight recorder was mounted in the aft equipment centre.

2.1 DFDR strip and examination

Internal inspection of the DFDR showed that there was considerable disruption to the control electronics circuits. The crash protection was removed and the plastic recording tape was found detached from its
various guide rollers and tangled in the tape spools. There was no tension in the negator springs. This indicated that the tape had probably moved since electrical power was removed from the recorder. The
position of the tape in relation to the record/replay heads was marked with a piece of splicing tape in order to quantify the movement. To ensure that no additional damage was caused to the tape it was
necessary to cut the negator springs to separate the upper and lower tape reels.

The crinkling and stretching of the tape and the damage to the control electronics meant that the tape had to be replayed outside the recorder. AAIB experience has shown that the most efficient method of
replaying stretched Lockheed recorder tapes is to re-spool the tape into a known serviceable recorder, in this case a Plessey 1584G.

2.2 DFDR replay

The 25 hour duration of the DFDR was satisfactorily replayed. Data relating to the accident flight was recorded on track 2. The only significant defect in the recording system was that normal acceleration was
inoperative. There was one area on the tape, 2 minutes from the end, where data synchronisation was lost for 1 second.

Decoding and reduction of the data from the accident flight showed that no abnormal behaviour of the data sensors had been recorded. The recorded data simply stopped. Figure C-1 is a graphical
representation of the main flight parameters.

2.3 DFDR analysis

In order to ensure that all recorded data from the accident flight had been decoded and to examine the quality of the data at the end of the recording, a section of tape, including both the most recently recorded
data and the oldest data (data from 25 hours past), was replayed through an ultra-violet (UV) strip recorder. The data was also digitised and the resulting samples used to reconstruct the tape signal on a VDU.

Both methods of signal representation were used to determine the manner by which the recorder stopped. There was no gap between the most recently recorded data and the 25 hour old data. This showed that
the recorder stopped while there was an incoming data stream from the FDAU. The recorder, therefore, stopped because its electrical supply was disconnected. The tape signal was examined for any transients
or noise signals that would have indicated the presence of electrical disturbances prior to the recorder stopping. None was found and this indicated that there had been a quick clean break of the electrical
supply.

The last seconds of data were decoded independently using both the UV record and the digitised signal. Only 17 bits of data were not recoverable (less that 23 milliseconds) and it was not possible to establish
with any certainty if this data was from the accident flight or if it was old data from a previous recording. 

A working group of the European Organisation for Civil Aviation Electronics (EUROCAE) was, during the period of the investigation, formulating new standards (Minimum Operational Performance
Requirement for Flight Data Recorder Systems, Ref:- ED55) for future generation flight recorders which would have permitted delays between parameter input and recording (buffering) of up to ? second.
These standards are intended to form the basis of new CAA specifications for flight recorders and may be adopted worldwide.

The analysis of the final data recorded on the DFDR was possible because the system did not buffer the incoming data. Some existing recorders use a process whereby data is stored temporarily in a memory
device (buffer) before recording. The data within this buffer is lost when power is removed from the recorder and in currently designed recorders this may mean that up to 1.2 seconds of final data contained
within the buffer is lost. Due to the necessary processing of the signals prior to input to the recorder, additional delays of up to 300 milliseconds may be introduced. If the accident had occurred when tha
aircraft was over the sea, it is very probable that the relatively few small items of structure, luggage and clothing showing positive evidence of the detonation of an explosive device would not have been
recovered. However, as flight recorders are fitted with underwater location beacons, there is a high probability that they would have been located and recovered. In such an event the final milliseconds of data
contained on the DFDR could be vital to the successful determination of the cause of an accident whether due to an explosive device or other catastrophic failure. Whilst it may not be possible to reduce some
of the delays external to the recorder, it is possible to reduce any data loss due to buffering of data within the data acquisition unit.

It is, therefore, recommended that manufacturers of existing recorders which use buffering techniques give consideration to making the buffers non-volatile, and hence recoverable after power loss. Although
the recommendation on this aspect, made to the EUROCAE working group during the investigation, was incorporated into ED55, it is also recommended that Airworthiness Authorities re-consider the concept
of allowing buffered data to be stored in a volatile memory.

3. Cockpit voice recorder (CVR)

The aircraft was equipped with a 30 minute duration 4 track Fairchild Model A100 CVR, and a Fairchild model A152 cockpit area microphone (CAM). The CVR control panel containing the CAM was
located in the overhead panel on the flight deck and the recorder itself was mounted in the aft equipment centre.

The channel allocation was as follows:-
 Channel 1
                        Flight Engineer's RTF. 
 Channel 2
                        Co-Pilot's RTF. 
 Channel 3
                        Pilot's RTF.
 Channel 4
                        Cockpit Area Microphone. 



3.1 CVR strip and examination

To gain access to the recording tape it was necessary to cut away the the outer case and saw through part of the crash protected enclosure. No damage to the tape transport or the recording tape was found. The
endless loop of tape was cut and the tape transferred to the replay equipment. The electronic modules in the CVR were crushed and there was evidence of long term overheating of the dropper resistors on the
power supply module. The CAM had been crushed breaking internal wiring and damaging components on the printed circuit board.

3.2 CVR replay

The erase facility within the CVR was not functioning satisfactorily and low level communications from earlier recordings was audible on the RTF channels. The CAM channel was particularly noisy, this was
probably due to the combination of the inherently noisy cockpit of the B747-100 in the climb and distortion from the incomplete erasure of the previous recordings. On two occasions the crew had difficulty
understanding ATC, possibly indicating high cockpit noise levels. There was a low frequency sound present at irregular intervals on the CAM track but the source of this sound could not be identified as of
either acoustic or electrical in origin. 

The CVR tape was listened to for its full duration and there was no indication of anything abnormal with the aircraft, or unusual in crew behaviour. The tape record ended with a sudden loud sound on the
CAM channel followed almost immediately by the cessation of recording. The sound occurred whilst the crew were copying their transatlantic clearance from Shanwick ATC.

3.3 Analysis of the CVR record

3.3.1 The stopping of the recorder

To determine the mechanism that stopped the recorder a bench test rig was constructed utilizing an A100 CVR and an A152 CAM. Figures C-2 to C-5 show the effect of shorting, earthing or disconnecting the
CAM signal wires. Figure C-8 shows the CAM channel signal response to the event which occurred on Flight PA103. From this it can be seen that there are no characteristic transients similar to those caused
by shorting or earthing the CAM signal wires. Neither does the signal stop cleanly and quickly as shown in Figure C-5, indicating that the CAM signal wires were not interrupted. The UV trace shows the
recorded signal decaying in a manner similar to that shown in Figure C-6, which demonstrates the effect of disconnecting electrical power from the recorder. The tests were repeated on other CVRs with
similar results and it is therefore concluded that Flight PA103's CVR stopped because its electrical power was removed.

Figures C-9A to C-9D show the recorded signals for the Air India B747 (AI 182) accident in the North Atlantic on 23 June 1985. These show that there is a large transient on the CAM track indicating
earthing or shorting of the CAM signal wires and that recorder power-down is more prolonged, indicating attempts to restore the electrical power supply either by bus switching or healing of the fault. The
Flight PA103 CVR shows no attempts at power restoration with the break being clean and final.

In order to respond to events that result in the almost immediate loss of the aircraft's electrical power supply it was therefore recommended during the investigation that the regulatory authorities consider
requiring CVR systems to contain a short duration (i.e. no greater than 1 minute) back-up power supply.

3.3.2 Information concerning the event

Figure C-8 is an expanded UV trace of the final milliseconds of the CVR record. Three tracks have been used, the flight engineer's RTF channel which contained similar information to the P2's channel has
been replaced with a timing signal. Individual sections of interest are identified by number. On the bottom trace, the P1 RTF track, section 1 is part of the Shanwick transatlantic clearance. During this section
the loud sound on the CAM channel is evident. 

Examination of the DFDR event recordings shows that the Shanwick oceanic clearance was being received on VHF2, the aerial for which is on the underside of the fuselage close to the seat of the explosion.
Section 2 identifies a transient, on the P1 channel, typical of an end of ATC transmission transient for this CVR. The start and finish of most of the recorded ATC transmissions were analysed and they
produce a similar signature to the three shown in Figure C-10. The signature on the P1 channel more closely resembles the end of transmission signature and it is open to conjecture that this transient was
caused by the explosion damaging the aerial feeder and/or its supporting structure.

Section 3 shows what is considered to be a high speed power supply transient which is evident on all the RTF channels and is probably on the CAM channel, but cannot be identified because of the automatic
gain control (AGC), limiting the audio event. This transient is considered to coincide with the loss of electrical power to the CVR. Section 5 identifies the period to the end of recording and this agrees well
with tests carried out by AAIB and independently by Fairchild as part of the AI 182 investigation. The typical time from removal of the electrical supply until end of recording is 110 milliseconds.

During the period identified as section 4 it is considered that the disturbances on the RTF channels are electrical transients probably channelled through the communications equipment. Section 6 identifies the
170 millisecond period from the point when the sound was first heard on the CAM until the recording stopped. 

The CAM unit is of the old type which has a frequency response of 350 to 3500 Hz. The useable duration of the signal is probably confined to the first 60 milliseconds of the final 170 milliseconds and even
during this period the AGC is limiting the signal. In the remaining time the sound is being distorted because power to the recorder has been disconnected. The ambient cockpit noise may have been high
enough to have caused the AGC to have been active prior to the event and in this event the full volume of the sound would not be audible. Distortion from the incomplete erasure of the last recording may
form part of the recorded signal. 

It is not clear if the recorded sound is the result of the explosion or is from the break-up of the aircraft structure. The short period between the beginning of the event and the loss of electrical power suggests
that the latter is more likely to be the case. 

Additionally some of the frequencies present on the recording were not present in the original sound, but are the result of the rise in total harmonic distortion caused by the increased amplitude of the incoming
signal. Outputs from a frequency analysis of the recorded signal for the same frequency of input to the CVR, but at two input amplitudes, are shown in Figures C-11 and C-12. These illustrate the effects on
harmonic distortion as the signal level is increased. Finally the recorded signal does not lend itself to analysis by a digital spectrum analyser as it is, in a large measure, aperiodic and most digital signal
analysis algorithms are unable to deal with a short duration signal of this type, however, it is hoped that techniques being developed in Canada will enable more information to be deduced from the end of the
recording.

In the aftermath of the Air India Boeing 747 accident (AI 182) in the North Atlantic on 23 June 1985 the Royal Armaments Research and Development Establishment (RARDE) were asked informally by
AAIB to examine means of differentiating, by recording violent cabin pressure pulses, between the detonation of an explosive device within the cabin (positive pulse) and a catastrophic structural failure
(negative pulse). Following the Lockerbie disaster it was considered that this work should be raised to a formal research project. Therefore, in February 1989, it was recommended that the Department of
Transport fund a study to devise methods of recording violent positive and negative pressure pulses, preferably utilising the aircraft's flight recorder systems. 

Preliminary results from these trials indicates that if a suitable sensor can be developed its output will need to be recorded in real time and therefore it may require wiring into the CVR installation. This will
further strengthen the requirement for battery back up of the CVR electrical power supply.

4. Flight recorder electrical system

4.1 CVR/DFDR electrical wiring.

The flight recorders were located in the left rear fuselage just forward of the rear pressure bulkhead. Audio information to the CVR ran along the left hand side of the aircraft, at stringer 11. Electrical power to
the CVR followed a similar route on the right hand side of the aircraft crossing to the left side above the rear passenger toilets. DFDR electrical power and signal information followed the same route as the
CVR audio information. 

4.2 Flight recorder power supply

The DFDR, CVR and the transponders were all powered from the essential alternating current (AC) bus. This bus was capable of being powered by any generator, however, in normal operation the selector
switch on the flight engineers panel is selected to "normal" connecting the essential bus to number 4 generator. When the cockpit of Flight PA103 was examined the selector switch was found in the normal
position.

4.3 Aircraft alternating current power supplies

AC electrical power to the aircraft was provided by 4 engine driven generators, see Figure C-13. Each generator was driven at constant speed through a constant speed drive (CSD) and connected to a separate
bus-bar through a generator control breaker (GCB). The 4 generators were connected to a parallel bus-bar (sync bus) by individual bus tie breakers (BTBs). Control and monitoring of the AC electrical system
was achieved through the flight engineer's instrument panel. In normal operation the generators operated in parallel, i.e with the BTBs closed.

4.4 Fault conditions

Analysis of the CVR CAM channel signal indicated that approximately 60 milliseconds after the sound on the CAM channel an electrical transient was recorded on all 4 channels and that approximately 110
milliseconds later the CVR had ceased recording. Within the accuracy of the available timing information it is believed that the incoming VHF was lost at the same time, indicating an AC power supply fault.

The AC electrical system was protected from faults in individual systems or equipment by fuses or circuit breakers. Faults in the generators or in the distribution bus-bars and feeders were dealt with
automatically by opening of the GCBs and opening or closing of the BTBs. In the event of fault conditions causing the disconnection of all 4 generators electrical power for essential services, including VHF
radio, was provided by a battery located in the cockpit.

The short time interval of 55 milliseconds after which the AC supply to the flight recorders was lost limits the basis on which a fault path analysis of the AC electrical system can be undertaken. On the
available information only a differential (feeder) fault could have isolated the bus-bar this quickly, with the generator field control relay taking 20 milliseconds to trip. However, in normal operation, the
generators would have been operating in parallel and the essential AC bus-bar would have been supplied via the number 4 BTB from the sync bus. If the fault conditions had continued, a further 40 to 100
milliseconds would have elapsed before the BTB opened. If the BTB was open prior to the fault it would have attempted to close and restore the supply to the essential bus. Any automatic switching causes
electrical transients to appear on the CVR and data losses on the FDR. Both the CVR and the FDR indicate that a clean break of the AC supply occurred with no electrical transients associated with BTBs open
or closing in an attempt to restore power. In the absence of any additional information only two possibilities are apparent:

i) That all 4 generators were simultaneously affected causing a total loss of AC electrical power. The feeders for the left and right side generators run on opposite sides of the aircraft under the passenger cabin
floor. The only situation envisaged that could cause simultaneous loss of all 4 generators is the disruption of the passenger cabin floor across its entire width. 

ii) That disruption of the main equipment centre, housing the control units for the AC electrical system, caused the loss of all AC power. However, again it would have to affect both the left and right sides of
the aircraft as the control equipment is located at left and right extremes of the main equipment centre. 

The nature of the event may also produce effects that are not understood. It is also to be noted that a sudden loss of electrical power to the flight recorders has been reported in other B747 accidents, e.g. Air
India, AI 182.

5. Seismic data

The British Geological Survey has a number of seismic monitoring stations in Southern Scotland. Stations close to Lockerbie recorded a seismic event caused by the wing section crashing on Lockerbie. The
seismic monitors are time correlated with the British Telecom Rugby standard. Using this and calculating the time for the various waves to reach the recording stations it was possible for the British Geological
Survey to conclude that the event occurred at 19.03:36.5 hrs ± 1 second.

Attempts were made to correlate various smaller seismic events with other wreckage impacts. However, this was not conclusive because the nearest recording station was above ground and due to the high
winds at the time of the accident had considerable noise on the trace. In addition, little of the other wreckage had the mass or impact velocity to stimulate the sensors.

6. Time correlation

6.1 Introduction

The sources of each time encoded recording were asked to provide details of their time standard and any known errors in the timings on their recordings. Although the resolution of the recorded time sources is
high it was not possible to attach an accuracy of better than ±1 second due to possible errors in synchronising the recorded time with the associated standard. The following time sources were available and
used in determining the significant events in the investigation:-

i) ATC

ATC communications were recorded along with a time signal. The time source for the ATC tape was the British Telecom "Tim" signal. Any error in setting the time when individual tapes are mounted was
logged.

ii) Recorded rada data

A time signal derived from the British Telecom "Rugby" standard was included on radar recordings. The Rugby and Tim times were assumed to be of equal accuracy for timing purposes. 

iii) The DFDR had UTC recorded.

The source of this time was the flight engineer's clock. This clock was set manually and therefore this time was subject to a significant fixed error as well any inaccuracy in the clock. 

iv) The CVR had no time signal.

However, the CVR was correlated with the ATC time through the RTF and with the DFDR, by correlating the press to talk events on the FDR with the press to talk signature on the CVR.

v) Seismic recordings

Seismic recordings included a timing signal derived from the British Telecom Rugby standard.

6.2 Analysis and correlation of times

The Scottish and Shanwick ATC tapes were matched with each other and with the CVR tape. The CVR recording speed was adjusted by peaking its recorded 400 Hz AC power source frequency. This
correlation served as a double check on any fixed errors on the ATC recordings and to fix events on the CVR to UTC. The timing of the sound on the CAM channel of the CVR was made simpler because
Shanwick was transmitting when it occurred. From this it was possible to determine that the sound on the CVR occurred at 19.02:50 hrs ±1 second.

With the CVR now tied to the Tim standard it was possible to match the RTF keying on the CVR with the RTF keying events on the FDR. These events on the FDR were sampled and recorded once per
second, it was therefore possible for a 1 second delay to be present on the FDR. This potential error was reduced by obtaining the best fit between a number of RTF keyings and a time correlation between the
FDR and CVR of ±? second was achieved. From this it was determined, within this accuracy, that electrical power was removed from the CVR and FDR at the same time.

From the recorded radar data it was possible to determine that the last recorded SSR return was at 19.02:46.9 hrs and that by the next rotation of the radar head a number of primary returns, some left and right
of track, were evident. Time intervals between successive rotations of the radar head became more difficult to use as the head painted more primary returns.

The point at which aircraft wreckage impacted Lockerbie was determined using the time recorded by seismic activity detectors. A seismic event measuring 1.6 on the Richter scale was detected and, with
appropriate time corrections for times of the waves to reach the sensors, it was established that this occurred at 19.03:36.5 hrs ±1 second. A further check was made by triangulation techniques from the
information recorded by the various sensors.

7. Recorded radar information

7.1 Introduction

Recorded radar information on the aircraft was available from from 4 radar sites. Initial analysis consisted of viewing the recorded information as it was shown to the controller on the radar screen, from this it
was clear that the flight had progressed in a normal manner until Secondary Surveillance Radar (SSR) was lost. There was a single primary return received by both Great Dun Fell and Claxby radars
approximately 16 seconds before SSR returns were lost. The Lowther Hill and St. Annes radars did not see this return. The Great Dun Fell radar recording was watched for 1 hour both before and after this
single return for any signs of other spurious returns, but none was seen. The return was only present for one paint and no explanation can be offered for its presence.

7.2 Limitations of recorded radar data

Before evaluating the recorded radar data it is important to highlight limitations in radar performance that must be taken into account when interpreting primary radar data. The radar system used for both
primary and secondary radar utilised a rotating radar transmitter/receiver (Head). This means that a return was only visible whilst the radar head was pointing at the target, commonly called painting or
illuminating the target. In the case of this accident the rotational speeds of the radar heads varied from approximately 10 seconds for the Lowther Hill Radar to 8 Seconds for the Great Dun Fell Radar.

Whilst it was possible to obtain accurate positional information within a resolution of 0.09° of bearing and ± 1/16 nautical mile range for an aircraft from SSR, incorporating mode C height encoding, primary
radar provided only slant range and bearing and therefore positional information with respect to the ground was not accurate.

The structural break-up of an aircraft releases many items which were excellent radar reflectors eg. aluminium cladding, luggage containers, sections of skin and aircraft structure. These and other debris with
reflective properties produce "clutter" on the radar by confusing the radar electronics in a manner similar to chaff ejected by military aircraft to avoid radar detection. 

Even when the target is not masked by clutter repetitive detection of individual targets may not be possible because detection is a function of the target effective area which, for wreckage with its irregular
shape, is not constant but fluctuates wildly. These factors make it impossible to follow individual returns through successive sweeps of the radar head.

7.3 Analysis of the radar data

The detailed analysis of the radar information concentrated on the break-up of the aircraft. The Royal Signals and Radar Establishment (RSRE) corrected the radar returns for fixed errors and converted the
SSR returns to latitude and longitude so that an accurate time and position for the aircraft could be determined. This information was correlated with the CVR and ATC times to establish a time and position
for the aircraft at the initial disintegration. 

For the purposes of this analysis the data from Great Dun Fell Radar has been presented. Figures C-14 to C-23 show a mosaic picture of the radar data i.e. each figure contains the information on the preceding
figure together with more recently recorded information. Figure C-14 shows the radar returns from an aircraft tracking 321°(Grid) with a calculated ground speed of 434 kts. Reading along track (towards the
top left of Figure C-14) there are 6 SSR returns with the sixth and final SSR return shown decoded: squawk code 0357 (identifying the aircraft as N739PA); mode C indicating FL310; and the time in seconds
(68566.9 seconds from 00:00, i.e. 19.02:46.9 hrs).

At the next radar return there is no SSR data, only 4 primary returns. One return is along track close to the expected position of the aircraft if it had continued at its previous speed and heading. There are 2
returns to the left of track and 1 to the right of track. Remembering the point made earlier about clutter, it is unlikely that each of these returns are real targets. It can, however, be concluded that the aircraft is
no longer a single return and, considering the approximately 1 nautical mile spread of returns across track, that items have been ejected at high speed probably to both right and left of the aircraft. Figure C-15
shows the situation after the next head rotation. There is still a return along track but it has either slowed down or the slant range has decreased due to a loss of altitude.

Each rotation of the radar head thereafter shows the number of returns increasing with those first identified across track in Figure C-14 having slowed down very quickly and followed a track along the
prevailing wind line. Figure C-20 shows clearly that there has been a further break-up of the aircraft and subsequent plots show a rapidly increasing number of returns, some following the wind direction and
forming a wreckage trail parallel to and north of the original break-up debris. Additionally it is possible that there was some break-up between these points with a short trail being formed between the north and
south trails. From the absence of any returns travelling along track it can be concluded that the main wreckage was travelling almost vertically downwards for much of the time.

The geographical position of the final secondary return at 19.02:46.9 hrs was calculated by RSRE to be OS Grid Reference 15257772, annotated Point A in Appendix B, Figure B-4, with an accuracy
considered to be better than ±300 metres This return was received 3.1±1 seconds before the loud sound was recorded on the CVR at 19.02:50 hrs. By projecting from this position along the track of 321°(Grid)
for 3.1±1 seconds at the groundspeed of 434 kts, the position of the aircraft was calculated to be OS Grid Reference 14827826, annotated Point B in Appendix B, Figure B-4, within an accuracy of ±525
metres. Based on the evidence of recorded data only, Point B therefore represents the geographical position of the aircraft at the moment the loud sound was recorded on the CVR. 

8. Conclusions

The almost instant destruction of Flight PA103 resulted in no direct evidence on the cause of the accident being preserved on the DFDR. The CVR CAM track contained a loud sound 170 milliseconds before
recording ceased. Sixty milliseconds of this sound were while power was applied to the recorder; after this period the amplitude decreased. It cannot be determine whether the decrease was because of reducing
recorder drive or if the sound itself decreased in amplitude. Analysis of both flight recorders shows that they stopped because the electrical supply was removed and that there were valid signals available to
both recorders at that time.

The most important contribution to the investigation that the flight recorders could make was to pinpoint the time and position of the event. As the timescale involved was so small in relation to the resolution
and accuracy of many of the recorded time sources it was necessary to analyse collectively all the available recordings. From the analysis of the CVR, DFDR, ATC tapes, radar data and the seismic records it
was concluded that the loud sound on the CVR occurred at 19.02:50 hrs ±1 second and wreckage from the aircraft crashed on Lockerbie at 19.03:36.5 hrs ±1 second, giving a time interval of 46.5 ±2 seconds
between these two events. When the loud sound was recorded on the CVR, the geographical position of the aircraft, based on the evidence of recorded data, was calculated to be within 525 metres of OS Grid
Reference 14827826. 

Eight seconds after the sound on the CVR the Great Dun Fell radar showed 4 primary radar returns. The returns indicated a spread of wreckage in the order of 1 nautical mile across track. On successive
returns of the radar, two parallel wreckage trails are seen to develop with the second trail, to the north, becoming evident 30 to 40 seconds after the first. 






APPENDIX D

CRITICAL CRACK CALCULATIONS

It was assumed that the fuselage rupture and associated star-burst petalling process was driven by an expanding 'bubble' of high pressure gas, produced by the conversion of solid explosive material into gas
products. As the explosive gas pressures reduced due to dissipation through the structure and external venting, the service differential pressure loading would have taken over from the explosive pressures as
the principal force driving the skin fractures.

The high temperature gas would initially have been confined within the container where, because of the low volume, the pressure would have been extremely high (too high for containment) and the gas
bubble would have expanded violently into the cavities of the fuselage between the outer skin and the container. This gas bubble would have continued to expand, with an accompanying fall in pressure due to
the increasing volume combined with a corresponding drop in temperature.

The precise nature of the gas expansion process could not be determined directly from the evidence and it was therefore necessary to make a number of assumptions about its behaviour, based on the geometry
of the hull and the area of fuselage skin which the high pressure bubble would have ruptured. Essentially, it was assumed that the gas bubble would expand freely in the circumferential direction, into the
cavity between the fuselage skin and the container. In contrast, the freedom for the bubble to expand longitudinally would have been restricted by the presence of the fuselage frames, which would have
partially blocked the passage of gas in the fore and aft directions. However, the pressures acting on the frames would have been such that they would have buckled and failed, allowing the gas to vent into the
next 'bay', producing failure of the next frame. This sequential frame-failure process would have continued until the pressure had fallen to a level which the frames could withstand. During the period of frame
failure and the associated longitudinal expansion of the gas bubble, this expansion rate was assumed to be half that of the circumferential rate.

It was assumed that venting would have taken place through the ruptured skin and that the boundary of the petalled hole followed behind the expanding gas bubble, just inside its outer boundary, i.e. the
expanding gas bubble would have stretched and 'unzipped' the skins as it expanded. This process would have continued until the gas bubble had expanded/vented to a level where the pressure was no longer
able to drive the petalling mechanism because the skin stresses had reduced to below the natural strength of the material.

The following structural model was assumed:
 (i)
             The pressurised hull was considered to be a cylinder of radius 128
             inches, divided into regular lengths by stiff frames. 
 (ii)
             The contributions of the stringers and frames beyond the petalled
             region were considered to be the equivalent of a reduction of stress
             in the skins by 20%, corresponding to an increase in skin thickness
             from 0.064 inches to 0.080 inches. 
 (iii)
             Standing skin loads were assumed to be present due to the service
             differential pressure, i.e.. it was assumed that no significant venting
             of internal cabin pressure occurred within the relevant timescale. 
 (iv)
             The mechanism of bubble pressure load transfer into the skins was: 


 a)
             Hoop direction -conventional membrance reaction into hoop
             stresses 
 b)
             Longitudinal direction - reaction of pressures locally by the frames,
             restrained by the skins. 


The critical crack calculations were based upon the generalised model of a plate under biaxial loading in which there was an elliptical hole with sharp cracks emanating from it. This is a good approximation of
the initial condition, i.e.. the shattered hole, and an adequate representation of the subsequent phase, when the hole was enlarging in its star-burst, petalling, mode.

The analyses of critical crack dimensions in the circumferential and longitudinal directions were based on established Fracture Resistance techniques. The method utilises fracture resistance data for the
material in question to establish the critical condition at which the rate of energy released by the crack just balances the rate of energy absorbed by the material in the cracking process, i.e. the instantaneous
value of the parameter Kr, commonly referred to as the fracture toughness Kc. From this, the relationship between critical stress and crack length can be determined.

Using conventional Linear Elastic Fracture Mechanics (LEFM) with fracture toughness data from RAE experimental work and published geometric factors relating to cracks emanating from elliptical holes,
the stress levels required to drive cracks of increasing lengths in both circumferential and longitudinal directions were calculated. The skin stresses at sequential stages of the expanding gas bubble/skin
petalling process were then calculated and compared with these data.

The results of the analysis indicated that, once the large petalled hole had been produced by explosive gas overpressure, the hoop stresses generated by fuselage pressurisation loads acting alone would have
been sufficient to drive cracks longitudinally for large distances beyond the boundaries of the petalled hole. Thus, with residual gas overpressure acting as well, the 43 feet (total length) longitudinal fractures
observed in the wreckage are entirely understandable. The calculations also suggested that the hoop fractures, due to longitudinal stresses in the skins, would have extended beyond the boundary of the petalled
hole, though the excess stress driving the fractures in this direction would have been much smaller than for the longitudinal fractures, and the level of uncertainty was greater due to the difficulty of producing
an accurate model reflecting the diffusion of longitudinal loads into the skins. Nevertheless, the results suggested that the circumferential cracks would extend downwards just beyond the keel, and upwards as
far as the window belt - conclusions which accord reasonably well with the wreckage evidence. 

APPENDIX E

POTENTIAL REMEDIAL MEASURES

1. Introduction

In the following discussion, those damage mechanisms which appear to have contributed to the catastrophic structural failure of Flight PA103 are identified and possible ways of reducing their damaging
effects are suggested. These suggestions are intended to stimulate thought and discussion by manufacturers, airworthiness authorities, and others having an interest in finding solutions to the problem; they are
intended to serve as a catalyst rather than to lay claim to a definitive solution. On the basis of the Flight PA103 investigation, damage is likely to fall into two categories: direct explosive damage, and indirect
explosive damage. 

2. Direct explosive damage

The most serious aspect of the direct explosive damage on the structure is the large, jagged aperture in the pressure hull, combined with frame and stringer break-up, which results from the star-burst rupture of
the fuselage skin. Because of its uncontrolled size and position, and the naturally radiating cracks which form as part of the petalling process, the skin's critical crack length (under pressurisation loading) is
likely to be exceeded, resulting in unstable crack propagation away from the boundary of the aperture. Such cracks can lead to a critical loss of structural integrity at a time when additional loads are likely to
be imposed on the structure due to reflected blast pressure and/or aircraft aerodynamic and inertial loading.

A further complicating factor is that the size of this aperture is likely to be sufficiently large to allow complete cargo containers and other debris to be ejected into the airstream, with a high probability of
causing catastrophic structural damage to the empennage. 

3. Indirect explosive damage

Indirect explosive damage (channelling or ducting of explosive energy in the form of both shock waves and supersonic gas flows) is likely to occur because of the network of interlinked cavities which exist, in
various forms, in all large commercial aircraft, particularly below cabin floor level. This channeling mechanism can produce critical damage at significant distances from the source of the explosion.

In addition to the structural damage, aircraft flight control and other critical systems will potentially be disrupted, both by the explosive forces and as a result of structural break-up and distortions. The
discussion which follows focuses on possible means of limiting structural damage of the kind which occurred on Flight PA103. Undoubtedly, such measures will also have beneficial effects in limiting systems
damage. However, system vulnerability can further be reduced by applying, wherever possible, those techniques used on military aircraft to reduce vulnerability to battle damage; multiplexed, multiply
redundant systems using distributed hardware to minimise risk of a single area of damage producing major system disruption. Fly by wire flight control systems potentially offer considerable scope to achieve
these goals, but the same distributed approach would also be required for the electronic and other equipment which, in current aircraft, tends to be concentrated into a small number of 'equipment centres'.

4. Remedial measures to reduce structural damage

Whilst pure containment of the explosive energy is theoretically possible, in an aviation context such a scheme would not be viable. Any unsuccessful attempt to contain the explosive will probably produce
greater devastation than the original (uncontained) explosion since all the explosive energy would merely be stored until the containment finally ruptured, when the stored energy would be released together
with massive fragmentation of the containment. 

However, a mixed approach involving a combination of containment, venting, and energy absorption should provide useful gains provided that a systematic rather than piecemeal approach is adopted, and that
the scheme also addresses blast channelling. The following scheme is put forward for discussion, primarily as means of identifying, by example, how the various elements of the problem might be approached
at a conceptual level and to provide a stimulus for debate. No detailed engineering solutions are offered, but it is firmly believed that the requirements of such a scheme could be met from a technical
standpoint. The proposed scheme is based on the need to counter a threat similar to that involving Flight PA103, i.e. a high explosive device placed within a baggage container, however, the principles should
be applicable to other aircraft types.

Such a scheme might comprise several 'layers' of defence. The first two layers, one within the other, are essentially identical and provide partial containment of the explosive energy and the redirection of blast
out from the compartment via pre-determined vent paths. Although the containment is temporary, it must provide an effective barrier to uncontrolled venting, preventing the escape of blast except via the
pre-designated paths.

The third layer comprises a pre-determined area of fuselage skin, adjoining the outer end of the vent path, designed to rupture or burst in a controlled manner, providing a large vent aperture which will not
tend to crack or rupture beyond the designated boundaries.

A fourth layer of protection has two elements, both intended to limit the propagation of shock waves through the internal cavities in the hull. The first element comprises the closure of any gaps between the
vent apertures in the two innermost containment layers and the vent aperture in the outer skin. This effectively provides an exhaust duct connecting the inner and outer vent apertures to minimise leakage into
the intervening structure and cavities around the cargo hold. The second element comprises the incorporation of an energy absorbing lining material within all the cavities in the lower hull, to absorb shock
energy, limit shock reflection and limit the propagation of pressure waves which might enter the cavities, for example because of containment layer breakthrough. 

5 Possible application to Boeing 747 type aircraft

5.1 Container Modification

The obvious candidates for the inner containment layer are the baggage containers themselves. Existing containers are of crude construction, typically comprising aluminium sheet sides and top attached to an
aluminium frame with a fabric reinforced access curtain, or have sides and top of fibreglass laminate attached to a robust aluminium base section.

These containers are stacked in the aircraft in such a manner that on three sides (except for the endmost containers) the baggage within the adjoining containers provides an already highly effective energy
absorbing barrier. If the container is modified so that loading access is via the outboard side of the container rather than at the end, i.e. the curtain is put on the faces shown in Figure E-1, then only the top and
base are 'unbacked' by other containers, leaving the outboard face as a vent region.

The proposal is therefore that a modified container is developed in which the access is changed from the end to the outside face only, and which is modified to improve the resistance to internal pressures and
thus encourage venting via the new access curtain only. How the container is actually modified to achieve the containment requirement is a matter of detail design, but two approaches suggest themselves,
both involving the use of composite type materials. The first approach is to adopt a scheme for a rigid container which relies on a combination of energy absorption and burst strength to prevent uncontrolled
breakout of explosive energy. The second approach is to use a 'flexible' container, i.e. rigid enough for normal use, but sufficiently flexible to allow gross deformation of shape without rupture. This,
particularly if used with a backing blanket made from high performance material to resist fragmentation, could deform sufficiently to allow the container to bear against, and partially crush, adjoining
containers. In this way, the shock energy transmission should be significantly reduced and the inherent energy absorption capability and mass of the baggage in adjoining containers could be utilised, whilst
still retaining the high pressure gas for long enough to allow venting via the side face. Clearly, care would need to be taken to ensure that the container vent aperture remained as undistorted as possible, to
ensure minimal leakage at the interface.

5.2 Cargo bay liner

The existing cargo bay liner is a thin fibreglass laminate which lines the roof and sidewalls of the cargo hold. There is no floor as such; instead, the containers are supported on rails running fore and aft on the
tops of the fuselage frame lower segments. In a number of areas, there are zipped fabric panels let into the liner to provide access to equipment located behind. The liner 'ceiling' is suspended on plastic pillars
approximately 2 centimeters below the bottom of the main cabin floor beams. The purpose of the liner is solely to act as a general barrier to protect wiring looms and systems components.

The proposal is to produce a new liner designed to provide the second level of containment, essentially at 'floor' and 'roof' level only [Figure E-1]. The dimensional constraints are such that potentially quite
thick material could be incorporated (leaving aside the weight problem), permitting not only a rigid liner design, but semi-rigid or flexible linings backed by energy absorbing blanket materials.

The liner would be designed to provide an additional barrier at the base and roof of the containers, which unlike the sides, are not protected by adjoining containers. The outside ends of these barrier elements
must effectively seal against the vent apertures in the containers, to minimise leakage into the fuselage cavities. 

5.3 Structural blow-out regions.

The final element in the containment/venting part of the scheme is a line of blow-out regions in the fuselage skins, coinciding exactly with the positions of the vent apertures in the cargo containers and cargo
bay liner. These should extend along the length of the cargo hold, zoned in such a way that rupture due to rapid overpressure will occur in a controlled manner. The primary function of the blow-out regions
would be to provide immediate pressure relief by allowing the inevitable skin rupture to take place only within pre-determined zones, limiting the extent of the skin tearing by means of careful stiffness control
at the boundary of the blow-out regions.

The structural requirements of such panels are perhaps the most difficult challenge to meet, particularly for existing designs. However, it is believed that by giving appropriate consideration to the
directionality of fastening strengths, and the use of external tear straps, it should be possible to design the structure to carry the normal service loads whilst creating a pre-disposition to rupturing in a controlled
manner in response to gross pressure impulse loading.

The implementation of such features will need carefully balanced design in order to provide local stiffening, sufficient to control and direct the tear processes, without creating stiffness discontinuities which
could lead to fatigue problems during extended service. However, the degree of reinforcement needed at the blow-out aperture need only be sufficient to limit tearing and to sustain the aircraft long enough to
complete the flight unpressurised.

All aircraft have pre-existing strength discontinuities, despite the efforts of the designers to eliminate them. By choosing the positions of butt joints, lap joints, anti-tear straps and similar structural features in
future designs, so as to incorporate them into the boundary of the blow-out panel region, the natural "tear here" tendencies of such features could possibly be turned to advantage. In the case of current
generation aircraft, the positions of existing lines of weakness at such features will determine the optimum position for structural blow-out areas, and hence the positions of the container and cargo bay liner
blow-out panels. A limited amount of local structural reinforcement (e.g. in the form of external anti-tear straps), carried out as part of a modification program, could perhaps fine tune the tearing properties of
existing lines of weakness, potentially producing significant improvements.

5.4 Closure of cavities

There are four main classes of cavity which will need to be addressed on the Boeing 747, and most other modern aircraft. These are: 
 (i)
            The channels formed between fuselage frames 
 (ii)
            The cross-ship cavities between cabin floor beams 
 (iii)
            Longitudinal 'manifold' cavities on each side of the cargo deck,
            running fore and aft in the space behind the upper sidewall areas of
            the cargo bay liner. 
 (iv)
            Air conditioning vents along the bottom of the cabin side-liner panels,
            which connect the side cavities below cabin floor level with the main
            passenger cabin. 


If the containment barriers (i.e. modified cargo containers and cargo hold liner) can be made to prevent blast breakthrough into these cavities directly, then the only area where transfer can occur is at the
interface between the container/cargo hold liner vent apertures and the fuselage skins at the blow-out region. This short distance will need to be sealed in order to form a short 'exhaust duct' between the
container vent aperture and the fuselage skin. Since the shock and general explosive pressure will act mainly along the vent-duct axis, the pressure loading on the vent duct walls should not be excessive.

5.5 Attenuation of shock waves in structural cavities

To prevent the 'ducting' of any blast which does enter the fuselage cavities, either because of partial penetration of the containment barriers or leakage at the vent duct interfaces, the scheme requires the
provision of lightweight energy absorbing material within the cavities to limit reflection and propagation of pressure waves within the cavities, and radiation of shock waves into the cabin from the
conditioning air vents. Materials such as vermiculite, which are of low density yet have excellent explosive energy absorption properties, may have application in this area, perhaps in lieu of the existing
insulation material.

Since the existing cavities often serve as part of the air conditioning outflow circuit, some consideration will need to be given to finding an alternative route. However, the flow rates are small compared with
the total cross-sectional flow potential of the cavities and this function could be served by separate air conditioning ducts, or perhaps by restricting access to one or two cavities only (thus limiting the risk), or
by using some form of blast valve to close off the air conditioning vents. Similarly, the requirement to vent pressure from the cabin in the event of a cargo bay decompression would also need to be addressed.

APPENDIX F

BAGGAGE CONTAINER EXAMINATION, RECONSTRUCTION AND RELATIONSHIP TO THE AIRCRAFT STRUCTURE

1. Introduction

During the wreckage recovery operation it became apparent that some items, identified as parts of baggage containers, exhibited blast damage. It was confirmed by forensic scientists at the Royal Armaments
Research and Development Establishment (RARDE), after detailed physical and chemical examination, that these items showed conclusive evidence of a detonating high performance plastic explosive. It was
therefore decided to segregate identifiable container parts and reconstruct any that showed evidence from the effect of Improvised Explosive Device (IED). It was evident, from the main wreckage layout that
the IED had been located in the forward cargo hold and, although all baggage container wreckage was examined, only items from the forward hold showing the relevant characteristics were considered for the
reconstruction. This Appendix documents the reconstruction of two particular containers and, from their position within the forward fuselage, defines the location of the IED.

2 Container Arrangement

Information supplied by Pan Am showed that this aircraft had been loaded with 12 baggage containers and two cargo pallets in the forward hold located as shown in Figure F-1. Three containers were recorded
as being of the glass fibre reinforced plastic type (those at positions 11L, 13L and 21L) with the remaining 9 being of metal construction.

3. Container Description

All the baggage containers installed in the forward cargo hold were of the LD3 type (lower deck container, half width - cargo) and designated with the codes AVE, for those constructed from aluminum alloy,
and AVA or AVN for those constructed from fibreglass. Each container was specifically identified with a four digit serial number followed by the letters PA and this nine digit identifier was present at the top
of three sides of each container in black letters/numbers approximately 5 inches tall. Detail drawings and photographs of a typical metal container are shown in Figure F-2. Each container was essentially a 5
feet cube with a 17 inch extension over its full length to the left of the access aperture. In order to fit within the section of the lower fuselage this extension had a sloping face at its base joining the edge of the
container floor to the left vertical sidewall at a position some 20 inches above the floor. The access aperture on the AVE type container was covered by a blue reinforced plastic curtain, fixed to the container
at its top edge, braced by two wires and central and lower edge cross bars which engaged with the aperture structure. The strength of this type of container superstructure was provided by the various extruded
section edge members, attached to a robust floor panel, with a thin aluminum skin providing baggage containment and weatherproofing.

4. Container Identification

Discrimination between forward and rear cargo hold containers was relatively straightforward as the rear cargo hold wreckage was almost entirely confined to the town of Lockerbie and was characteristically
different from that from the forward hold, in that it was generally severely crushed and covered in mud. The forward hold debris, by comparison, was mostly recovered from the southern wreckage trail some
distance from Lockerbie and had mainly been torn into relatively large sections.

All immediately identifiable parts of the forward cargo containers were segregated into areas designated by their serial numbers and items not identified at that stage were collected into piles of similar parts for
later assessment. As a result of this two containers, one metal and one fibreglass, were identified as exhibiting damage likely to have been caused by the IED. From the Pan Am records the metal container of
these two had been positioned at position 14L, and the fibreglass at position 21L (adjacent positions, 4th and 5th from the front of the forward cargo hold on the left side). The serial numbers of these
containers were respectively AVE 4041 PA and AVN 7511 PA.

5. Container Reconstruction

Those parts which could be positively identified as being from containers AVE 4041 PA and AVN 7511 PA were assembled onto one of three wooden frameworks; one each for the floor and superstructure of
container 4041, and one for the superstructure of container 7511. Figures F-3 to F-9 show the reconstruction of container 4041 and Figure F-10 shows the reconstructed forward face of container 7511.
Approximately 85% of container 4041 was identified, the main missing sections being the aft half of the sloping face skin and all of the curtain. Two items were included which could not be fracture or tear
matched to container 4041, however, they showed the particular type of blast damage exhibited only by items from this container.

While this work was in progress a buckled section of skin from container 4041 was found by an AAIB Inspector to contain, trapped within its folds, an item which was subsequently identified by forensic
scientists at the Royal Armaments Research and Development Establishment (RARDE) as belonging to a specific type of radio-cassette player and that this had been fitted with an improvised explosive device.

Examination of all other component parts of the remaining containers from the front and rear cargo holds did not reveal any evidence of blast damage similar to that found on containers 4041 and 7511. 

6. Wreckage Distribution

Those items which were positively identified as parts of container 4041 or 7511, and for which a grid reference was available, were found to have fallen close to the southern edge of the southern wreckage
trail. This indicated that one of the very early events in the aircraft break-up sequence was the blast damage to, and ejection of, parts of these two containers.

7. Fuselage Reconstruction

In order to gain a better understanding of the failure sequence, that part of the aircraft's fuselage encompassing the forward cargo hold was reconstructed at AAIB Farnborough. After all available blast
damaged pieces of structure had been added, the floor of container 4041 was installed as near to its original position as the deformation of the wreckage would allow and this is shown in Figure F-11. The
presence of this floor panel in the fuselage greatly assisted the three-dimensional assessment of the IED location. Witness marks between this floor and the aircraft structure, tie down rail, roller rail and
relative areas of blast damage left no doubt that container 4041 had been located at position 14L at the time of detonation.

8. Analysis

The general character of damage that could be seen on the reconstructions of containers 4041 and 7511 was not of a type seen on the wreckage of any of the other containers examined. In particular, the
reconstruction of the floor of container 4041 revealed an area of severe distortion, tearing and blackening localised in its aft outboard quarter which, together with the results of the forensic examination of
items from this part of the container, left no doubt that the IED had detonated within this container.

Within container 4041 the lack of direct blast damage (of the type seen on the outboard floor edge member and lower portions of the aft face structural members) on most of the floor panel in the heavily
distorted area suggested that this had been protected by, presumably, a piece of luggage. The downward heaving of the floor in this area was sufficient to stretch the floor material, far enough to be cut by
cargo bay sub structure, and distort the adjacent fuselage frames. This supported the view that the item of baggage containing the IED had been positioned fairly close to the floor but not actually placed upon
it. The installation of the floor of container 4041 into the fuselage reconstruction (Figure F-11) showed the blast to have been centered almost directly above frame 700 and that its main effects had not only
been directed mostly downwards and outboard but also rearwards. The blast effects on the aircraft skin were onto stringer 39L but centered at station 710 (Figure F-12). Downwards crushing at the top, and
rearwards distortion of frame 700 was apparent as well as rearwards distortion of frame 720.

With the two container reconstructions placed together it became apparent that a relatively mild blast had exited container 4041 through the rear lower face to the left of the curtain and impinged at an angle on
the forward face of container 7511. This had punched a hole, Figure F-10, approximately 8 inches square some 10 inches up from its base and removed the surface of this face inboard from the hole for some
50 inches. Radiating out from the hole were areas of sooting, and other black deposits, extending to the top of the container. No signs were present of any similar damage on other external or internal faces of
container 7511 or the immediately adjacent containers 14R and 21R.

The above assessment of the directions of distortion, comparison of damage to both containers, and the related airframe damage adjacent to the container position, enabled the most probable lateral and vertical
location of the IED to be established as shown in Figure F-13, centered longitudinally on station 700. 

9. Conclusions

Throughout the general examination of the aircraft wreckage, direct evidence of blast damage was exhibited on the airframe only in the area bounded, approximately, by stations 700 and 720 and stringers 38L
and 40L. Blast damage was found only on pieces of containers 4042 and 7511, the relative location and character of which left no doubt that it was directly associated with airframe damage. Thus, these two
containers had been loaded in positions 14L and 21L as recorded on the Pan Am cargo loading documents. There was also no doubt that the IED had been located within container 14L, specifically in its aft
outboard quarter as indicated in Figure F-13, centered on station 700.

Blast damage to the forward face of container 7511 was as a direct result of hot gases/fragments escaping from the aft face of container 4041. No evidence was seen to suggest that more than one IED had
detonated on Flight PA103. 

APPENDIX G


MACH STEM SHOCK WAVE EFFECTS

1. Introduction

An explosive detonation within a fuselage, in reasonably close proximity to the skin, will produce a high intensity shock wave which will propagate outwards from the centre of detonation. On reaching the
inner surface of the fuselage skin, energy will partially be absorbed in shattering, deforming and accelerating the skin and stringer material in its path. Much of the remaining energy will be transmitted, as a
shock wave, through the skin and into the atmosphere but a significant amount of energy will be returned as a reflected shock wave, which will travel back into the fuselage interior where it will interact with
the incident shock to produce Mach stem shocks - re-combination shock waves which can have pressures and velocities of propagation greater than the incident shock.

The Mach stem phenomenon is significant for two reasons. Firstly, it gives rise (for relatively small charge sizes) to a geometric limitation on the area of skin material which the incident shock wave can
shatter. This geometric limitation occurs irrespective of charge size (within the range of charge sizes considered realistic for the Flight PA103 scenario), and thus provides a means of calculating the standoff
distance of the explosive charge from the fuselage skin. Secondly, the Mach stem may have been a significant factor in transmitting explosive energy through the fuselage cavities, producing damage at a
number of separate sites remote from the source of the explosion.

2. Mach stem shock wave formation 

A Mach stem shock is formed by the interaction between the incident and reflected shock waves, resulting in a coalescing of the two waves to produce a new, single, shock wave. If an explosive charge is
detonated in a free field at some standoff distance from a reflective surface, then the incident shock wave expands spherically until the wave front contacts the reflective surface, when that element of the wave
surface will be reflected back (Figure G-1). The local angle between the spherical wave front and the reflecting surface is zero at the point where the reflecting surface intersects the normal axis, resulting in
wave reflection directly back towards the source and maximum reflected overpressure at the reflective surface. The angle between the wave front and the reflecting surface at other locations increases with
distance from the normal axis, producing a corresponding increase in the oblique angle of reflection of the wave element, with a corresponding reduction in the reflected overpressure. (To a first order of
approximation, explosive shock waves can be considered to follow similar reflection and refraction paths to light waves, ref: "Geometric Shock Initiation of Pyrotechnics and Explosives", R Weinheimer,
McDonnel Douglas Aerospace Co.) Beyond some critical (conical) angle about the normal axis, typically around 40 degrees, the reflected and incident waves coalesce to form Mach stem shock waves which,
effectively, bisect the angle between the incident and reflected waves, and thus travel approximately at right angles to the normal axis, i.e.parallel with the reflective surface (detail "A", figure G-1).

3. Estimation of charge standoff distance from the fuselage skin

Within the constraint of the likely charge size used on Flight PA103, calculations suggested that the initial Mach stem shock wave pressure close to the region of Mach stem formation (i.e. the shock wave
face-on pressure, acting at right angles to the skin), was likely to be more than twice that of the incident shock wave, with a velocity of propagation perhaps 25% greater. However, the Mach stem out-of-plane
pressure, i.e.the pressure felt by the reflecting surface where the Mach stem touches it, would have been relatively low and insufficient to shatter the skin material. Therefore, provided that the charge had
sufficient energy to produce skin shatter within the conical central region where no Mach stems form, the size of the shattered region would be a function mainly of charge standoff distance, and charge weight
would have had little influence. Consequently, it was possible to calculate the charge standoff distance required to produce a given size of shattered skin from geometric considerations alone. On this basis, a
charge standoff distance of approximately 25 to 27 inches would have resulted in a shattered region of some 18 to 20 inches in diameter, broadly comparable to the size of the shattered region evident on the
three-dimensional wreckage reconstruction.

Whilst the analytical method makes no allowance for the effect of the IED casing, or any other baggage or container structure interposed between the charge and the fuselage skin, the presence of such a
barrier would have tended to absorb energy rather than re-direct the transmitted shock wave; therefore its presence would have been more critical in terms of charge size than of position. Certainly, the standoff
distance predicted by this method was strikingly similar to the figure of 25 inches derived independently from the container and fuselage reconstructions. 

barry@johnbarrysmith.com Copyright 2009, 2010