The biggest piece of avionics-related equipment to be installed recently in transport-category aircraft isn’t on the instrument panel in front of the pilots. It’s behind them: the hardened, electrically locked cockpit doors installed in the U.S. airline fleet and on foreign aircraft flying to the United States in the wake of the 9/11 terrorist attacks.
The "fortress" or "fortified" cockpit doors went a long way toward restoring public confidence in the aviation security system. On the other hand, because door designs were rushed into production and installed in a mobilized effort to meet an April 2003 deadline, growing pains were almost inevitable. As a result of that haste, a fair number of electrical, fitment and procedural problems ensued.
Pilot reports to NASA’s confidential (i.e., anonymous) aviation safety reporting system (ASRS) bear this out. These reports provide frank tales from the cockpit.
"On the surface, looking at the design, it seems foolproof. Not so!" declared one pilot, who reported that the seemingly locked door flopped open on climb. To be sure, none of the problems rises to the level of the electronic fortress door lock that fried itself April 20, 2003, on a British Airways B747. This malfunction filled the cockpit with smoke, forcing the airplane to make an emergency landing.
Many of the door problems fall under the heading of potential accident initiators:
They pop open on takeoff.
They pop open on landing.
Passengers have opened them (inadvertently).
They have locked out the pilots (calls of nature).
They have failed, with no fault found.
Lock switches are either too close to other switches or too far away from the pilots.
Incomplete checklists, incomplete or nonexistent abnormal standard operating procedures (SOPs) and minimum equipment list (MEL) procedures accompanied the door installations.
Maintenance write-ups were incomplete, with repeat events on the same aircraft.
Status indications (locked/unlocked) have been unclear or lacking entirely in some airplanes.
There has been insufficient allowance in the door design for the structural distortions caused by maximum pressurization differentials.
There is evidence of crew resource management (CRM) breakdowns and misunderstandings, particularly between the pilots in the cockpit and flight attendants in the cabin.
Taken in their entirety, the reports raise a question of quality control. Example: "The door can be opened with a simple push even though it indicates locked." Here are a few of the avionics-related aspects of fouled, foiled and failed cockpit doors:
Stuck Open
An MD-80 captain reports: When the flight attendant brought dinner to the cockpit, the new secure door got stuck in the open position. Repeated attempts to close the door were unsuccessful. I made a public address (PA) announcement to inform the passengers and ordered that they could only leave their seat with an OK from a flight attendant, and not doing so would constitute a hostile act.
The last three MD-80 aircraft flown had the new secure cockpit door swing open when electrical power was switched from ground or auxiliary power to engine power. The door is held locked by an electrical solenoid, which becomes de-energized when electrical power is switched, allowing the door to swing open.
Out of Reach
A B737-700 captain reports: Cockpit door opened on takeoff. I was facing into the sun as we maneuvered into takeoff position on the runway. I saw the first officer physically place his hand on the console as we ran the checklist. I glanced down but did not see the door unlocked light. Cockpit door switch [was] out of reach of seated pilots. Looking back at the switch itself is nearly impossible for a captain taxiing the aircraft.
Code Orange
A B757 pilot reports: On takeoff roll at about rotation the cockpit door came open. The door was reshut at about 1,000 feet above ground level by the flight attendant. The flight continued to our destination without incident. The problem is twofold. On the B757 there is no cockpit indication that the door is actually latched; we just rely on the flight attendant who closes it to verify the locking. I do not know if the problems are specific to my airline or are being found throughout the industry. `Code Orange’ is no time for us to find out the hard way!
Don’t Pull the Breaker
An A300 pilot reports: Pilots on the A300 need to be aware that the cockpit door will not lock and there will be no unusual indications if the door circuit breaker is pulled. It would be helpful to notify maintenance that this can cause a security problem and request they no longer pull the breaker. It would be a good idea to include the door breaker as one that [is] alerted on ECAM [electronic caution alert module], when it is pulled.
Looking Foolish
A B767-400 captain reports: I was flying one of the first of our B767-400 aircraft to be equipped with the new secure cockpit door. The first officer had gone to the back. I was sitting there in my full-face oxygen mask thinking that when the first officer called to return, I needed to select cabin microphone to be able to talk to him. He called and I selected cabin microphone and answered him. I then reselected the microphone for VHF No. 1 and heard him knock.
I reached up to unlock the door, but instead turned the standby electrical power switch to off. The autopilot and auto throttles disengaged. I immediately realized what I had done and returned the standby power switch to auto. I manually took control of the aircraft and moved the cockpit door switch to unlock. Boy, did I feel foolish!
The new cockpit door controller is just above the standby power switch and both switches are similar. The thing that disturbs me the most about this incident is the captain’s inboard [instrument] display was inoperative for the remainder of the flight after the power interruption.
At the least, I feel the crew bulletin describing the operation of the cockpit door controller should warn of the close proximity and similarity of the switches.
Accident/Incident Waiting to Happen
A B767 captain reports: The new cockpit door release switch for the B767 is located directly above the standby power switch. Both are similar in shape, size and tactile design. Turning the door switch to open is the exact same way you turn off standby power. It’s a human factors accident/incident waiting to happen. (Author comment: good thing the door switch was not placed next to the fuel cutoff switch.)
Callback conversation: The reporter said his company has recognized the problem and for the interim has installed a guard for the standby power switch and plans to relocate the door switch to another location on the panel.
Undetectable Problem
A B777-200 pilot reports: Mechanics were working on what was described as a transformer rectifier unit problem. I was a bit suspicious of the door, so I asked the other first officer to stay in the cockpit while I tried to force it open. I opened it on the first try. My concern was that this door problem was undetectable, since the door appeared to be normal when latched closed. It wasn’t until you forced it open that its failure became obvious.
I realized the MEL (minimum equipment list) card did not correctly reflect the problem we had with the door, since it did not say anything about being able to easily force open the closed door. A mechanic could easily check the door and find that the auto locking system appeared to work normally, and sign off the door.
The door problems may relate to the fact that normal build and inspection standards were dropped in the urgency to get reinforced, electronically locked cockpit doors in place. Still, the pilots’ ASRS reports, taken in their entirety, raise a question of quality control. When it comes to the fortress doors, one might say it is not exactly an open-and-shut situation.
David Evans can be reached by e-mail at [email protected].