Aviation Investigation Report A01F0094

A First Air Boeing 727-225 aircraft, C-FIFA, serial number 20381, was on a regular scheduled cargo flight from Corcaigh International Airport, Ireland, to East Midland Airport, England. Shortly after take-off, as the landing gear was retracting, the aft cargo door light illuminated on the second officer's annunciator panel. He informed the other crew members of the anomaly as the aircraft climbed through 400 feet above ground level. Shortly thereafter, the N^o 3 engine experienced a series of compressor stalls. The captain shut down the engine (Pratt & Whitney JT8D-15) and requested an immediate return to Corcaigh Airport. The aircraft landed uneventfully; airport emergency response services were standing by. The aft cargo door was partially open, and the door-opening mechanism was damaged. No one was injured.

Boeing 727 C-FIFA was on extended chartered operations to Air Contractors Ireland Ltd. The aircrew arrived at Corcaigh Airport approximately 1½ hours before a planned departure time of 2045 local time.^{Footnote 1} The three crew members - the captain, the first officer, and the second officer - had a full day of rest before the start of their duty day. They were certified and qualified for the flight in accordance with existing regulations. The aircraft was serviced and maintained in accordance with existing directives, and there was no indication of any system malfunction before the flight.

Reported weather at the time of the incident was as follows: broken ceiling at 3000 feet above ground level, tops at 5000 feet, light winds, and good visibility. All significant events - loading of the aircraft, engine start-up, take-off, and landing 34 minutes later - occurred during daylight conditions.

On arrival at the airport, the second officer proceeded to the aircraft to carry out pre-flight and pre-start duties. While conducting an external inspection, he noted that the aft cargo and main cargo doors were open in preparation for loading. The aft airstairs were also deployed. While the flight crew made their way to the cockpit in preparation for departure, ground personnel were getting ready to load the aircraft through the main cargo door on the left side and through the aft cargo door on the right side by the N^o 3 engine.

Servisair Ltd. provides aircraft ground handling^{Footnote 2} in Corcaigh under the supervision of DHL Aviation, an international courier company operating on behalf of Air Contractors Ireland Ltd. While DHL Aviation is responsible for providing ground-handling operations at major airports, this responsibility is usually subcontracted to a third-party handling agent in smaller stations. In Corcaigh, the ground-handling responsibility was delegated to Servisair Ltd., but a local DHL Aviation staff member was responsible for building the loads, producing weight and balance forms, and supervising Servisair Ltd. Under the contract, Servisair Ltd. is responsible for securing and closing all aircraft cargo doors before engine start-up. Nevertheless, a local procedure at Corcaigh delegates the task of loading the aircraft through the aft cargo door to DHL Aviation.

The aircraft was loaded while all three flight crew members were in the cockpit going through their pre-start checklist procedures. A DHL Aviation staff member was loading the aft cargo area of the aircraft in accordance with established local procedures. While testing the annunciator panel for the first time, the second officer did not pay any attention to the aft cargo or main cargo door lights because the aircraft was still being loaded. After completion of the aircraft loading through the aft and main cargo doors, a Servisair Ltd. agent handed the second officer a cargo form describing the nature and weight of the on-board cargo for weight and balance calculations. The second officer then interrupted his pre-start duties and exited the cockpit area to close and secure the main cargo door and the aft airstairs, as per established procedures. While stowing the airstairs, he did not observe the position of the aft cargo door because this area is often being loaded right up to engine start.

The second officer then re-entered the aircraft through the left side passenger door and proceeded back to the cockpit area to resume pre-start and start duties. At that time, he looked at the annunciator panel and noted that the main cargo and aft cargo lights on the annunciator panel were not illuminated; this confirmed that all cargo doors were secured. The three crew members then initiated the challenge and response "Clear to Start" checklist. Before the three engines were started, a Servisair Ltd. agent standing next to the captain's window on the left side gave a thumbs-up to the crew, signifying that personnel were clear of the aircraft and that the crew were cleared to start. Because of the position of the aircraft on the ramp, a pushback was not required before taxi; therefore, the checklist items under "push back" were not actioned.

The Boeing 727 normal checklist calls for the second officer to visually check the annunciator light panel on three occasions: before engine start, after engine start, and before the aircraft takes off. The second officer visually checked the panel as per the checklist. Before take-off, the captain double-checked the panel to visually confirm that all lights were extinguished before departure. On all three occasions, the annunciator panel check requires the pushing of a button to illuminate all panel lights to confirm that they are serviceable and the subsequent release of the same button to verify that they will extinguish. If a door light does not extinguish after this check, the corresponding door is not properly closed and secured.

During take-off, the captain and the first officer moved their attention outward, and the second officer maintained a scan on the engine instruments, his primary duty for that phase. Shortly after lift-off, as the gear was selected up, the second officer leaned back and noticed that the aft cargo door light on the annunciator panel was illuminated. After the first officer reported the aircraft climbing through the take-off obstacle clearance altitude, the second officer informed the crew that the aft cargo door light was illuminated. The captain acknowledged this information. Following flap retraction, the aircraft experienced a series of compressor stalls on the N^o 3 engine, located a few feet downstream from the aft cargo door. The captain brought the engine N^o 3 thrust lever to idle, levelled the aircraft above the broken layer of cloud, and requested an immediate diversion back to Corcaigh Airport. The "One Engine Inoperative" drill was carried out, engine N^o 3 was secured, and the aircraft landed uneventfully on two engines. The aircraft stopped on the runway and was visually inspected by an emergency response services crew who responded to the scene. Minutes later, the emergency response services crew reported to the aircrew that the aft cargo door was partially open, the hinge mechanism was slightly bent, and the door handle fully protracted. There was no apparent damage to the engine or the structure of the aircraft. The aircraft then taxied to the ramp.

After engine shutdown, the aircrew attempted to determine which of the two agencies, DHL Aviation or Servisair Ltd., was responsible for securing the aft cargo door. This responsibility could not be ascertained at that time. Later, the DHL Aviation agent who loaded parcels through the aft cargo door could not recollect if he had closed the door upon completion of the loading. Two of the five parcels loaded in the aft cargo area remained on board; one was found on the runway just before the end, one was found on the grass area past the end of the runway, and the last was returned by a person who lived near the airport boundary.

The aft cargo door structure, door stops (latches), and hinge attach points were not damaged; however, the right and left hinge rods were bent, preventing the door from closing. The door warning mechanism - switch, wires, and warning light - was tested several times by forcefully moving the electrical switch and wires, attempting to extinguish the warning panel aft cargo light with the door open and to recreate the possibility of such system malfunction. No faults were found. The hinges were dismantled to allow closing and securing the aft cargo door. The door was closed and the warning light extinguished. The aircraft rear cargo area was pressurized and retained pressure within an acceptable range, confirming that the door was properly secured.

On July 24, after receiving authorization from the Irish Aviation Authorities and Boeing, the aircraft was ferried, with one engine inoperative and the aft door secured, to Copenhagen, Denmark, for repairs. These repairs included replacing the bent hinges and the locking mechanism (door switch) and some minor repairs to the inner case of the engine N^o 3 turbine casing, damaged by the compressor stalls. No damage was found on the turbine blades. During or after the repair work, the door microswitch was inadvertently discarded and could not be found for analysis.

TSB was not informed of this reportable incident by the operator but received information from Transport Canada, System Safety, on July 24. Through coordination with the Aircraft Accident Investigation Agency in Ireland, the investigation was delegated to TSB on July 25.

The flight data recorder (FDR) and cockpit voice recorder (CVR) were downloaded, and the data were sent to the TSB Engineering Laboratory for analysis. Annunciator door lights and status or condition of doors are not recorded in the FDR. The flight lasted 34 minutes after rotation. The speed averaged 200 knots, with peaks to approximately 240 knots for one minute. The flight portion of the 30-minute loop CVR was written over as power was kept on for more than one hour after the incident to allow the crew and maintenance personnel to diagnose the door locking mechanism and the warning system. The CVR did not contain data from pre-start to the occurrence.

The Boeing Aircraft Company provided information regarding previous inadvertent door openings in flight. Since December 1976, 10 cases of airborne inadvertent door openings have been reported to Boeing for the 727 type, including this occurrence. The causes are usually undetermined. However, the US National Transportation Safety Board (NTSB) investigated and documented one event that occurred on 05 January 1999 (NTSB Report N^o LAX99IA072). It was determined that a door opened because ground-handling personnel did not properly secure an aft cargo door and that a door warning light was intermittent due to contamination in proximity switch terminals. In other cases where a precise cause could not be determined, suspected causes were generally related to improper latching of doors combined with, in some instances, a malfunctioning warning light electrical system and/or switch.

Faulty microswitch operation is usually caused by oil or water contamination, unclean cannon plugs, or wiring problems. If a switch is considered too difficult to clean, it will be discarded and replaced by a new one. These switches have no shelf life and are not included in any special inspection. They are simply replaced as needed. A few weeks after this occurrence, an undocumented case of aft cargo warning light malfunction occurred on the ramp of First Air / Bradley Air Services Ltd. at the Ottawa / Macdonald-Cartier International Airport, Ontario, with the same Boeing 727 type. Various aircraft systems were being tested, and it was noticed that the warning light was out while the aft cargo door was open, indicating a malfunction of the concerned electrical system. The warning light was checked serviceable. The door microswitch was diagnosed as giving faulty indications. The switch was cleaned and reinstalled.

Aft cargo doors on Boeing 727's have been designed so that when properly closed and secured on the ground, the doors cannot inadvertently open in flight unless the whole door latching mechanism sustains a structural failure or breakdown. It is also physically impossible, by virtue of their design, to improperly close and secure the door. The door is opened in an upward direction by fully protracting the door handle, which then snaps and stays in that position. The door stay rod attached to the inside of the door is used to keep the door fully open for easy access.

To close and secure the aft cargo door, the stay rod is re-attached to the inside of the door, and the door is allowed to rotate downward by gravity, resting a few inches away from closing flat with the aircraft outer surface. With the door handle fully protracted, the door is pushed completely in against the aircraft structure, then the door handle is pushed in so it is flat with the surface of the aircraft's outer skin (fully retracted). The action of pushing in the door handle moves the four stops outward in each corner of the door. Provided that the door is resting against the fuselage, these male-type stops will first ramp up and then down into their respective, elbow-shaped, female-type aircraft mounted door stops (door latches) to properly secure the door.

Once the handle is fully in, a plunger mechanism is forced into the switch, which makes electrical contact and extinguishes the aft cargo warning light. If the door handle is pushed in (that is, partially or fully flat with the door) before the door is pushed completely in against the aircraft structure, extension of the moveable stops when the handle is pushed in will prevent these stops from locking in with the aircraft mounted door latches.

This safety mechanism makes it impossible to close the door flat with the aircraft structure if the handle is retracted and eliminates any possibility of the plunger electrical contact being made and the warning light being extinguished. When the handle is in and the door is not fully closed, the door remains ajar by about two feet. If the stay rod is stored and the door handle is protracted, the door will naturally rest close to the fuselage, just a few inches away from being flat with the aircraft outer skin. In this position, the fact that the door is not fully and properly closed is hardly noticeable to a loading crew.

The involved switch was discarded before it could be examined and tested by TSB; thus, it was not determined whether the switch was defective for the occurrence flight.

Because ground personnel are usually loading cargo up to the last minute before engine start, the second officer does not carry out a final, post-loading, pre-flight inspection of the aircraft before starting the engines, nor is it required by company procedures. The flight crew rely on cockpit annunciator warning lights to confirm the status of aircraft doors before engine start, taxi, and take-off. In a serviceable system, an illuminated light would indicate that an electrical contact is not being made inside the door microswitch, meaning that the door is not closed and secured. When aircraft systems are energized with the auxiliary power unit and the aft cargo door is partially or fully open, the light will be illuminated. An extinguished aft cargo light after loading and before engine start confirms that the aft cargo door is properly closed and secured. It is concluded that the second officer likely could not have repeatedly missed the aft cargo warning light being illuminated on his annunciator panel before take-off. Even in bright and sunny conditions, an illuminated light on the second officer's console is obvious. Furthermore, the same light panel was visually verified "clear of lights" by the captain before take-off, as required in the pre-start checklist procedures.

This investigation revealed no damage to the aircraft mounted door latches, the door structure, and the door moveable stops. Only the door hinges were found bent and had to be changed. The nature of this damage, combined with the door design and the status of the door handle when first inspected by emergency response services personnel suggest that, after cargo loading was completed, the door was likely left in the down position with the door handle fully protracted and the door stay rod stowed away.

The locations of the three parcels on the runway provide further evidence that the door was not fully closed before take-off. The door likely began to open as the aircraft initiated its rotation, and the force of the wind contributed directly to bending the door hinges. Although the aft cargo warning light was observed for the first time by the second officer as the gear was retracting, it is plausible that the light appeared earlier during the take-off roll. The second officer is required to turn his seat toward the front of the aircraft to monitor the engine instruments during the critical phase of the take-off roll and lift-off, he would not be looking at his annunciator panel. The advancement of thrust levers to full power, release of the brakes, take-off roll, rotation, and retraction of the landing gear are all conducive to airframe vibrations. These vibrations could have restored service to the aft cargo door microswitch mechanism. The subsequent engine compressor stalls coincided with raising the flaps. Airflow disruption, created by the closeness of an opened cargo door to the engine intake and redirected airflow resulting from a change of configuration most likely induced these stalls.

After working together at the local level for several years, Servisair Ltd. and DHL Aviation crews' direct responsibilities for loading an aircraft and securing all doors became ambiguous as both agencies worked to get the job done in a timely manner. Although the contract gives Servisair Ltd. responsibility for loading an aircraft, the local DHL Aviation staff member usually loads packages into the aft cargo area without disrupting the Servisair Ltd. team's loading in the main cargo area.

Although effective, this local division of responsibilities procedure has weaknesses. Without a clearly defined set of tasks and/or responsibilities, confusion or miscommunication between two different loading crews (that is, agencies) eager to do the job in an efficient and timely manner may lead to an omission of safety-related duties, such as closing and securing the aft cargo door. With the door stay rod stowed away, a slightly open door is hardly noticeable. The only defence left against departing with a door open is a warning light on the second officer's panel. This light can become disabled as a result of electrical contamination or malfunction. Within the DHL Aviation and Servisair Ltd. organizations, the pre-flight walk-around inspection is considered to be the flight crew's responsibility. When the crew is informed in the cockpit that loading is complete and all doors are closed, the loading crew is not expected to perform a final walk-around because ramp dispatch is not part of the contract.

Findings as to causes and contributing factors

1. The aft cargo door was most likely not closed and secured before engine start-up, taxi, and departure of the Boeing 727. As a result, the door opened during the take-off roll.
2. The aft cargo door microswitch likely malfunctioned, giving the crew an erroneous indication that the door was secured before take-off.

Findings as to risk

1. Servisair Ltd. and DHL Aviation's local procedure for loading an aircraft and securing cargo doors might have led to the omission of properly closing the aft cargo door.
2. When different agencies perform the same work without a clearly defined set of tasks or responsibilities, there is a risk of confusion and miscommunication that may lead to an omission of safety-related duties, such as closing and securing doors.

Other findings

1. This incident was reported to TSB four days after the event. By the time the investigation was delegated to TSB, critical information had been lost: the aft cargo door microswitch had been discarded and could not be examined or tested.

Safety action taken

On July 3^rd 2002, a meeting was held between Bradley Air Services Ltd and Servisair, where it was agreed that Servisair staff will be solely responsible for securing cargo doors on DHL aircraft. All DHL staff in Cork have been advised and will not be involved in this responsibility in the future.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 14 August 2002.