The companion piece “The door” gives the mechanism and the Safety Board’s tests of 1972. This piece gives the second set of tests, the French Commission of Inquiry’s, on the door that came down at Saint-Pathus and on a new door that Douglas lent, and the measurements by which the Commission found how fifty pounds had done what 120 had done at Windsor. Everything quoted is from the Commission’s report as the British Accidents Investigation Branch translated it in 1976.
The wreckage in the field
The door of TC-JAV came down in free fall from about 3,600 metres on to newly ploughed fields near Saint-Pathus and buried itself in soft earth, “so that they were little damaged on impact with the ground; any fractures occurred on ejection from the aircraft.” The Commission’s experts had the lower part of the door with its four hooks and their whole control and locking mechanism, the part carrying the handle, the link and the vent-door shaft, the operating arm, and the push rod’s detached top fitting. The vent door was not found, nor the actuator’s motor. They saw at once, in the field, “incomplete closing of the door latches,” “non-engagement of the lock-pins,” a handle out of its housing with a forced trigger, and links “which had not reached over-centre.” The parts went to Le Bourget and then to the Centre d’Essais des Propulseurs at Saclay.
Two references were ink-stamped on the door. One gave its serial as 46704/11 and its production inspection acceptance as fuselage 29. The examination of the mechanism produced a list.
On the instruction plate for working the actuator by hand there was a hole, “not prescribed by Douglas and drilled by THY, in order to gain direct access to the drive mechanism (incorrect execution of SB 52-38).” The link between the handle and the vent-door shaft was bent. “The additional support plate specified for the vent door shaft by SB 52-37 had not been installed.” The push rod between the shaft and the lock tube was bent and its two crank rivets sheared. The end of the lock tube had been chamfered “as prescribed by SB 52-37,” but “rough file marks and irregular scoring showed that this work was done manually.” Under the striker of the unlock limit switch were two Douglas shims and, on top of them, “a third shim with no reference number and consisting of a thin crumpled piece of metal leaf with numerous folds,” which the Commission called “unusual in equipment to aeronautical standards” and which “could only have entailed imprecision and erratic functioning of this switch,” though that switch, which closed the circuit for opening only, had no bearing on safety.
The Commission’s footnote on the plate is the sentence the entry turns on. Service Bulletin 52-37 “does not list TC-JAV among the aircraft affected by the relevant modification which ought to have been carried out by the manufacturer before delivery. As a result of an oversight by the manufacturer, the aircraft was delivered without the modification and the start of its application to the lock tube seems to show that work had begun on correcting the error retrospectively.”
The actuator at Zurich
The actuator went to the Swissair laboratories at Zurich, approved for maintaining it, with the Swiss federal authorities collaborating. Its shaft was extended 277.5 millimetres between its attachment axes; “normal extension required for correct closing of the latches is 297 mm.” Incomplete extension “can result only from premature stoppage of the electric motor,” and since the motor was never found, the Commission could not say whether a fault in the motor, its thermal protection, or an interrupted supply had stopped it, or whether the operator had let go of the switch too soon; TC-JAV had not yet had Service Bulletin 52-44, the light that told the operator the shaft had reached the end of its travel, though the parts were on order.
The edges of the four latch cranks’ flanges “showed heavy marks (detachment of paint and metal) made by the lock pins.” These marks, the Commission noted, “were not produced during the last flight, for in that case the latches would have been engaged. They show that in earlier circumstances the operation whereby over-centre is achieved was incomplete, for the pins must pass freely without any friction.” The washers of the actuator’s thrust bearing were broken; a bearing of the same kind broke at about 2,000 decanewtons on the bench, well under the 4,700 that had sheared the bolts; and the recovered actuator, with a good motor fitted, worked under 665 decanewtons and failed to go on beyond 1,080, short of its specified limit load of 1,160. Either the bearing had been failing already and loading the motor into its thermal cut-out, or it broke in the last seconds. The Commission could not choose, and did not. It recorded that “the door had had to be closed by the manual drive tool on numerous earlier occasions, which would confirm the hypothesis of erratic functioning of the actuator.”
The four switches were checked. Three worked. The lock limit warning switch “did not function (arm distorted).”
The lock rebuilt
Then the Commission rebuilt the lock. It straightened the lock tube, put the switch mounting back, fitted a new switch of the same type, and measured. The striker at the end of the tube carried ten shims, one of one part number, eight of another, one of a third, 15.9 millimetres in all. “When the lock tube was pushed towards the locked position, the switch switched off the flight deck warning light, although the ends of the lock pins were still 3 millimetres away from the restraining flanges.” The manual allowed two in the unlocked position. “In conclusion, the adjustment of the lock limit warning switch was defective and caused the flight deck warning light to go out when the latches were not necessarily closed.”
It then measured the two adjustable rods that set the lock tube’s travel, whose lockwire was still in place: the link at 302.79 millimetres between centres, the push rod at 914.38. Douglas lent a new door of the same type. The Commission took the support plate off it, “thus making it conform to the definition of the door with which TC-JAV was equipped,” set its rods to those lengths, and closed it.
With the latches closed and the handle down, the four pins went behind the flanges and held them, “but they were only partly engaged”: their ends were 1.6 millimetres short of the rear face, where the manual required 6.35 beyond it, so that the tube in its locked position was 7.95 millimetres short of the mark. With the latches open, the handle’s movement towards closed “was stopped when the lock pins came up against the front faces of the flanges.” Then the experimenters varied the adjustment and pulled.
“When this adjustment is in accordance with the manufacturer’s requirements, ie when the ends of the lock pins protrude for 6.35 mm beyond the rear faces of the flanges, it is physically impossible to force the handle even in the absence of the support plate for the vent door shaft (SB 52-37). On the other hand, when this distance of 6.35 mm is decreased, the force required for forced closure also decreases. It becomes theoretically nil when the end of the lock pin is in line with the front face of the flange.”
At TC-JAV’s adjustment, 7.95 millimetres short, “the handle could therefore be closed (and the vent door apparently closed) with a force of 22 daN (about 50 lbs).” The closure “was possible only because of deformation of the mechanism providing control transmission for the operation of the lock tube. The principal deformation affected the vent door shaft.” That was the shaft the missing plate was meant to brace. And the partial engagement reproduced on the new door “corresponds to the friction marks which they made on the edges of the flanges of the door of TC-JAV, which occurred only on the leading half of the edges.”
Two doors, two conclusions
The Commission’s conclusions on the two doors are short. On the new door: because of the defective adjustment of the lock tube’s travel, “the handle could be closed without excessive force, although the latches were not completely closed. Defective closure could not be detected from the external appearance of the handle, vent door and cargo door, unless a visual inspection was made through the view port provided for that purpose.” On TC-JAV’s: “The thickness of the striker shims made any correct adjustment of the lock pins impossible; any attempt to bring the ends of the lock pins to the correct distance of 6.35 mm beyond the rear face of the flanges inevitably led to damage to the lock limit warning switch.” Whoever had rigged the pins short had done so because the switch, shimmed as it was, would be crushed by a tube that travelled the full distance. The two faults made each other necessary.
Douglas’s production and inspection documents, received through the Safety Board, showed the pins on fuselage 29 adjusted to the full quarter of an inch at Long Beach, with the engineering order that specified it accomplished and verified. The Commission’s comment is the sentence the entry quotes: “These documents merely provide guarantees in accordance with prescribed forms, but the adjustments in question were also those shown in the Maintenance Manual (in particular Revision 4, January 1973) and had to be verified or applied again by the operator whenever any work was carried out on the door.”
Side by side
The Commission set Windsor beside Ermenonville in its own section. The points in common were four: the latches not fully closed and the pins not in place; the cockpit light out before the door was locked; the same height, and the same two bolts failing “under the same conditions”; and the floor, which in the absence of relief vents of adequate size was damaged in both, “less severe than in the case of TC-JAV in which the floor was more heavily loaded.” The differences were in degree and in the means of defeat. At Windsor the mechanism was rigged more or less as built, and it took 120 pounds to beat it. At Orly, with the plate missing, the tube short and the switch shimmed, it took fifty, and the Commission’s finding was that the handle could be pulled down “without the use of any abnormal force.” A handler who proceeded as usual, without any particular difficulty, would have noticed nothing, and said so.
The Safety Board’s own tests of 1972 had shown what fifty pounds would one day mean. The Board recommended that it be made physically impossible. The bulletins that answered made it harder, on the doors that got them, and then the harder door was rigged soft. The closed loop of 1974 did at last what the Board had asked, and the regulation that followed, the FAA’s Amendment 25-54, made it a rule for every outward-opening door on every transport aircraft certificated since: a window through which the locks can be seen, a warning that cannot be falsely cleared, and “provisions to prevent the initiation of pressurization of the airplane to an unsafe level if the door is not fully closed and locked.”