737 rudder issue

 • March 3, 1991
   ── united airline flight 585
   ── 737-200 in Colorado Springs in 1991
   ── summary: loss of control due to rudder hardover
   ── Widefield Park, El Paso county near Colorado springs municipal airport, colorado springs, colorado
   ──
   ── rolled to the right and went into a vertical dive
   ──
   ── On March 3, 1991, United Airlines Flight 585, a Boeing 737-200, rolled to the right and went into a vertical dive while attempting to land in Colorado Springs, Colorado. The resulting crash killed all 25 people on board. The National Transportation Safety Board (NTSB) conducted a thorough investigation. A rudder problem was suspected.  Because the aircraft's rudder components were severely damaged in the crash, the components could not be tested or fully evaluated.  As a result, the NTSB was unable to conclusively identify the cause of the crash.[1]: 47  << from www.wikipedia.org entry on Eastwind airline flight 517 >>
   ──
   ── during the landing approach, the plane rolled to the right and pitched nose-down into a near-vertical dive.
   ──
   ── On March 3, 1991, United Airlines Flight 585, a Boeing 737-200, crashed while attempting to land in Colorado Springs, Colorado. During the airplane's landing approach, the plane rolled to the right and pitched nose-down into a near-vertical dive.[2]: ix  The resulting crash destroyed the aircraft and killed all 25 people on board.[2]: ix  << from www.wikipedia.org entry on Boeing 737 rudder issues >>

 • April 11, 1994
   ── << from www.wikipedia.org entry on Boeing 737 rudder issues >>
   ──
   ── Boeing 737-300
   ── summary:
   ──
   ── rolled violently to the right and continued to pull to the right
   ──
   ── On April 11, 1994, a Continental Airlines pilot, Ray Miller, reported his aircraft rolled violently to the right and continued to pull to the right for another 18 minutes; the Boeing 737-300 landed safely. Continental removed the flight data recorder and rudder PCU from the incident aircraft and provided them to Boeing for investigation. Boeing concluded that the rudder had inadvertently moved due to an electrical malfunction, but only 2.5 degrees and for less than two minutes in total, a finding disputed by Ray Miller.[9]
   ── electrical malfunction, ([ what kind of electrical malfunction ])

 • September 8, 1994
   ── USAir Flight 427
   ── 737-300 near Pittsburgh in 1994
   ── summary:
   ── Hopewell Township, Pennsylvania
   ──
   ── abruptly rolled to the left while on approach
   ──
   ── On September 8, 1994, USAir Flight 427, a Boeing 737-300, abruptly rolled to the left while on approach to Pittsburgh International Airport in an accident very similar to that of Flight 585. The resulting crash killed all 132 people on board.[1]: 1  The NTSB's subsequent investigation persisted throughout the late 1990s.  << from www.wikipedia.org entry on Eastwind airline flight 517 >>  
   ──
   ── suddenly rolled to the left. Although the pilots were briefly able to roll right and level the plane, it rolled left a second time and the pilots were unable to recover.
   ──
   ── On September 8, 1994, USAir Flight 427, a Boeing 737-300, crashed near Pittsburgh, Pennsylvania. While on approach to Pittsburgh International Airport, Flight 427 suddenly rolled to the left. Although the pilots were briefly able to roll right and level the plane, it rolled left a second time and the pilots were unable to recover.[3]: 4  The resulting crash killed all 132 people on board.[3]: 9  The NTSB realized early into its investigation that the crash of Flight 427 might have been caused by an unintended or uncommanded rudder movement, similar to the suspected (but not yet established) cause of the Flight 585 crash.[3]: 44  As a result, the NTSB conducted additional testing on United Flight 585's Parker-Hannifin PCU servo during its Flight 427 investigation.[2]: 73  << from www.wikipedia.org entry on Boeing 737 rudder issues >>
   ── the gap in the flight data recorder (FDR), during which no data was recorded, lead Boeing to suspect and insist that the pilot had responded incorrectly to a wake turbulence incident.[6]  << from www.wikipedia.org entry on Boeing 737 rudder issues >>
   ── At the request of the NTSB, data from the Penny & Giles quick access recorder (QAR) of a British Airways (BA) Boeing 747-400 was supplied to the NTSB by BA. The data was from a London-Bangkok flight in which the aircraft suffered an uncommanded elevator movement and momentary elevator reversal on take-off, the aircraft then landed safely. Operating alongside the FDR system, the QAR on BA's 747-400s, in conjunction with a Data Management Unit, received and recorded more aircraft parametric data, including control input values at a higher rate.[7] This BA data led to renewed suspicion of the similar valve design used on the 737 rudder. As a result of this earlier BA incident, Boeing had, in fact, modified the design of the 747 elevator servo system, and the modified system had been retroactively fitted to all 747-400s in service.[6]  << from www.wikipedia.org entry on Boeing 737 rudder issues >>
   ── renewed suspicion of the similar valve design used on the 737 rudder
   ──

 • June 9, 1996
   ── Eastwind airline flight 517
   ── Boeing 737-200 (registration number N221US)
   ── Summary:  Uncommanded rudder hardover[1]
                loss of rudder control and the plane rolled sharply to the right
      ── As the plane continued to descend through 4,000 feet (1,200 m), the captain suddenly experienced a loss of rudder control and the plane rolled sharply to the right.[1]: 51 
   ──
   ── rolled sharply to the right.
   ── The aircraft experienced two episodes of rudder reversal while on approach to land
   ──
   ── On June 9, 1996, while the NTSB's investigation of Flight 427 was still ongoing, the pilots of Eastwind Airlines Flight 517 briefly lost control of their aircraft, a 737-200, while flying from Trenton, New Jersey, to Richmond, Virginia.[2]: ix  The aircraft experienced two episodes of rudder reversal while on approach to land in Richmond. Unlike the two prior incidents, the rudder issues on Flight 517 spontaneously resolved and the pilots were able to safely land the aircraft. One of the 53 people on board was injured.[3]: 51   << from www.wikipedia.org entry on Boeing 737 rudder issues >>
   ── On June 9, 1996, while operating a passenger flight from Trenton, New Jersey to Richmond, Virginia, the crew of Eastwind Airlines Flight 517 temporarily lost control of their Boeing 737-200 because of a rudder malfunction. The crew were able to regain control and land the aircraft successfully. One flight attendant was injured.
      ──<< from www.wikipedia.org entry on Eastwind airline flight 517 >>  
   ── Thermal shock testing revealed that the uncommanded rudder movement could be replicated by injecting a cold PCU with hot hydraulic fluid. Thermal shock resulted in the servo's secondary slide becoming jammed against the servo housing, and that when the secondary slide was jammed the primary slide could move to a position that resulted in rudder movement opposite of the pilot's commands.[2]: 79 [3]: 294  The NTSB concluded that all three rudder incidents (United Flight 585, USAir Flight 427, and Eastwind Flight 517) were most likely due to the PCU secondary slide jamming and excessive travel of the primary slide, resulting in the rudder reversal.[3]: 294  << from www.wikipedia.org entry on Boeing 737 rudder issues >>  
   ── Flight 517 was instrumental in resolving the cause of Boeing 737 rudder issues that had caused two previous fatal crashes because it was the first flight to experience such rudder issues and land safely, allowing investigators to interview the pilots about their experience and to study the aircraft.
   ──
   ── the captain felt a brief "kick" or "bump" on the right rudder pedal.
   ── the plane rolled sharply to the right.
   ──
   ── While on approach to Richmond International Airport, Richmond, Virginia, United States, at an altitude of about 5,000 feet (1,500 m) MSL, the captain felt a brief "kick" or "bump" on the right rudder pedal.[1]: 51  Around the same time, a flight attendant at the rear of the plane heard a thumping noise underneath her.[1]: 52  As the plane continued to descend through 4,000 feet (1,200 m), the captain suddenly experienced a loss of rudder control and the plane rolled sharply to the right.[1]: 51 
   ──

[[ ]]
 • December 19, 1997
<< look up silkair flight 185 >>
   ── SilkAir Flight 185
   ──
   ──
   ──
   ── On December 19, 1997, SilkAir Flight 185 crashed in Indonesia, killing 104 people. Because the crash involved a Boeing 737-300 rolling and diving toward the ground at a steep angle,
   ──

 •
   ──
   ──
   ____________________________________
<< from www.wikipedia.org entry on Boeing 737 rudder issues >>

Rudder function[edit]
Unlike other twin-engine large transport aircraft in service at the time, the Boeing 737 was designed with a single rudder panel and single rudder actuator.[2]: 14  The single rudder panel is controlled by a single hydraulic Power Control Unit (PCU).[2]: 13  Inside the PCU is a dual servo valve that, based on input from the pilot's rudder pedals or the aircraft's yaw damper system, directs the flow of hydraulic fluid in order to move the rudder.[2]: 19  The PCU for affected Boeing 737 aircraft was designed by Boeing and manufactured by Parker Hannifin.[2]: 20 

[[ ]]
Boeing 737 Rudder Design Study
<< look this up >>
http://www.airlinesafety.com/faq/B-737Rudder.htm
   ____________________________________
 • Rudder function
   ── single rudder panel and single rudder actuator
   ── rudder actuator
   ── The single rudder panel is controlled by a single hydraulic Power Control Unit (PCU).
   ── hydraulic Power Control Unit (PCU)
   ── Inside the PCU is a dual servo valve that, based on input from the pilot's rudder pedals or the aircraft's yaw damper system, directs the flow of hydraulic fluid in order to move the rudder.
   ── servo valve, rudder pedals, yaw damper system, hydraulic fluid  
   ── designed by Boeing
   ── manufactured by Park Hannifin.
   ____________________________________

wikipedia
March 3, 1991
united airline flight 585
loss of control due to rudder hardover
Widefield Park, El Paso county
near Colorado springs municipal airport, colorado springs, colorado

 • April 11, 1994 (a Continental Airlines pilot, Ray Miller) (??)

September 8, 1994
USAir Flight 427,
Boeing 737-300
Thursday, September 8, 1994, the Boeing 737 flying this route crashed in Hopewell Township, Pennsylvania

On September 8, 1994, USAir Flight 427, a Boeing 737-300, abruptly rolled to the left while on approach to Pittsburgh International Airport in an accident very similar to that of Flight 585. The resulting crash killed all 132 people on board.[1]: 1  The NTSB's subsequent investigation persisted throughout the late 1990s.

June 9, 1996
Eastwind airline flight 517 had a similar problem
Summary: Loss of control due to rudder hardover[1]
Flight 517 was instrumental in resolving the cause of Boeing 737 rudder issues that had caused two previous fatal crashes because it was the first flight to experience such rudder issues and land safely, allowing investigators to interview the pilots about their experience and to study the aircraft.
   ____________________________________
<< www.wikipedia.org entry on Eastwind airline flight 517 >>

At the request of the NTSB, data from the Penny & Giles quick access recorder (QAR) of a British Airways (BA) Boeing 747-400 was supplied to the NTSB by BA. The data was from a London-Bangkok flight in which the aircraft suffered an uncommanded elevator movement and momentary elevator reversal on take-off, the aircraft then landed safely. Operating alongside the FDR system, the QAR on BA's 747-400s, in conjunction with a Data Management Unit, received and recorded more aircraft parametric data, including control input values at a higher rate.[7] This BA data led to renewed suspicion of the similar valve design used on the 737 rudder. As a result of this earlier BA incident, Boeing had, in fact, modified the design of the 747 elevator servo system, and the modified system had been retroactively fitted to all 747-400s in service.[6]

Unlike other twin-engine large transport aircraft in service at the time, the Boeing 737 was designed with a single rudder panel and single rudder actuator.[2]: 14  The single rudder panel is controlled by a single hydraulic Power Control Unit (PCU).[2]: 13  Inside the PCU is a dual servo valve that, based on input from the pilot's rudder pedals or the aircraft's yaw damper system, directs the flow of hydraulic fluid in order to move the rudder.[2]: 19  The PCU for affected Boeing 737 aircraft was designed by Boeing and manufactured by Parker Hannifin.[2]: 20 

The single rudder panel is controlled by a single hydraulic Power Control Unit (PCU).[2]: 13

The NTSB and Boeing engineers conducted a series of tests on the PCUs from Flight 517 and Flight 427, as well as PCUs used in other aircraft and a brand-new PCU that had not yet been used in flight (the PCU from Flight 585, although it had been recovered, was too badly damaged to test in this manner).[3]: 71, 81–85  Testing revealed that under certain circumstances, the PCU's dual servo valve could jam and deflect the rudder in the opposite direction of the pilots' input.[3]: 81–85  Thermal shock testing revealed that the uncommanded rudder movement could be replicated by injecting a cold PCU with hot hydraulic fluid. Thermal shock resulted in the servo's secondary slide becoming jammed against the servo housing, and that when the secondary slide was jammed the primary slide could move to a position that resulted in rudder movement opposite of the pilot's commands.[2]: 79 [3]: 294  The NTSB concluded that all three rudder incidents (United Flight 585, USAir Flight 427, and Eastwind Flight 517) were most likely due to the PCU secondary slide jamming and excessive travel of the primary slide, resulting in the rudder reversal.[3]: 294 

The following Boeing 737 aircraft incidents were also suspected of being caused by a rudder PCU malfunction:

 • On June 6, 1992, Copa Airlines Flight 201, a 737-200 Advanced, flipped and crashed into the Darién Gap jungle, killing 47 people. Investigators initially believed that the airplane experienced a rudder malfunction, but after an exhaustive and extensive inquiry, they concluded that the crash was caused by faulty attitude indicator instrument readings.
 • On March 8, 1994, a Sahara Airlines aircraft that had three trainees and one supervising pilot on board crashed after performing a "touch-and-go landing" at New Delhi Airport and slammed into a Russian jet. The four pilots and five ground workers (a total of nine) were killed. Although repairs were done to the PCU with unauthorized parts, the incident is still thought to be in part due to the plane's rudder reversing both right and left.[9][10][11]
 • On April 11, 1994, a Continental Airlines pilot, Ray Miller, reported his aircraft rolled violently to the right and continued to pull to the right for another 18 minutes; the Boeing 737-300 landed safely. Continental removed the flight data recorder and rudder PCU from the incident aircraft and provided them to Boeing for investigation. Boeing concluded that the rudder had inadvertently moved due to an electrical malfunction, but only 2.5 degrees and for less than two minutes in total, a finding disputed by Miller.[9]
 • On February 23, 1999, MetroJet Flight 2710, a 737-200, experienced a slow deflection of the rudder to its blowdown limit while flying at 33,000 feet above Salisbury, Maryland. While a rudder malfunction was suspected, the aircraft was an older 737 and its flight data recorder only recorded 11 flight parameters, compared to the hundreds of parameters recorded by newer aircraft. NTSB chairman Jim Hall said that the investigation was "hampered by the lack of basic aircraft data."[12][13] All 112 passengers and five crew members (117 total) survived the incident.

On December 19, 1997, SilkAir Flight 185 crashed in Indonesia, killing 104 people. Because the crash involved a Boeing 737-300 rolling and diving toward the ground at a steep angle,
   ____________________________________

737-200 in Colorado Springs in 1991

https://en.wikipedia.org/wiki/List_of_accidents_and_incidents_involving_commercial_aircraft#1991

March 3, 1991
https://en.wikipedia.org/wiki/Boeing_737_rudder_issues

Testing revealed that under certain circumstances, the PCU's dual servo valve could jam and deflect the rudder in the opposite direction of the pilots' input.[3]: 81–85  Thermal shock testing revealed that the uncommanded rudder movement could be replicated by injecting a cold PCU with hot hydraulic fluid. Thermal shock resulted in the servo's secondary slide becoming jammed against the servo housing, and that when the secondary slide was jammed the primary slide could move to a position that resulted in rudder movement opposite of the pilot's commands.[2]: 79 [3]: 294  The NTSB concluded that all three rudder incidents (United Flight 585, USAir Flight 427, and Eastwind Flight 517) were most likely due to the PCU secondary slide jamming and excessive travel of the primary slide, resulting in the rudder reversal.[3]: 294 

As a result of the NTSB's findings, the Federal Aviation Administration ordered that the servo valves be replaced on all 737s by November 12, 2002.[8]

investigators considered the possibility of rudder hardover due to PCU servo malfunction.[14]

https://en.wikipedia.org/wiki/List_of_accidents_and_incidents_involving_commercial_aircraft#1994

https://en.wikipedia.org/wiki/Boeing_737_rudder_issues

On September 8, 1994, USAir Flight 427, a Boeing 737-300, crashed near Pittsburgh, Pennsylvania. While on approach to Pittsburgh International Airport, Flight 427 suddenly rolled to the left. Although the pilots were briefly able to roll right and level the plane, it rolled left a second time and the pilots were unable to recover.[3]: 4  The resulting crash killed all 132 people on board.[3]: 9 

https://en.wikipedia.org/wiki/USAir_Flight_427
Thursday, September 8, 1994, the Boeing 737 flying this route crashed in Hopewell Township, Pennsylvania

Summary: Loss of control due to rudder hardover[1]

After the longest investigation in the history of the National Transportation Safety Board (NTSB), it was determined that the probable cause was that the aircraft's rudder malfunctioned and went hard over in a direction opposite to that commanded by the pilots, causing the plane to enter an aerodynamic stall from which the pilots were unable to recover. All 132 people on board were killed, making the crash the deadliest air disaster in Pennsylvania's history.

Several employees of the U.S. Department of Energy had tickets to take later flights, but used them to fly on Flight 427.

 The NTSB remarked that no airline had ever trained a pilot to properly recover from the situation experienced by the Flight 427 pilots and that the pilots had just 10 seconds from the onset of the roll to troubleshoot before recovery of the aircraft was impossible.[11]: 153

Investigators later discovered that the recovered accident rudder power control unit was much more sensitive to bench tests than other new such units. The exact mechanism of the failure involved the servo valve, which remains dormant and cold for much of the flight at high altitude, seizing after being injected with hot hydraulic fluid that has been in continuous action throughout the plane. This specific condition occurred in fewer than 1% of the lab tests but explained the rudder malfunction that caused Flight 427 to crash. The jam left no trace of evidence after it occurred, and a Boeing engineer later found that a jam under this controlled condition could also lead to the slide moving in the opposite direction than that commanded. Boeing felt that the test results were unrealistic and inapplicable given the extremes under which the valve was tested.[13][11]

   ── The exact mechanism of the failure involved the servo valve, which remains dormant and cold for much of the flight at high altitude, seizing after being injected with hot hydraulic fluid that has been in continuous action throughout the plane.
   ── The jam left no trace of evidence after it occurred, and a Boeing engineer later found that a jam under this controlled condition could also lead to the slide moving in the opposite direction than that commanded.

The NTSB concluded that similar rudder problems had caused the previously mysterious March 3, 1991 crash of United Airlines Flight 585 and the June 9, 1996 incident involving Eastwind Airlines Flight 517, both Boeing 737s.[1]: 292–295  The final report also included detailed responses to Boeing's arguments about the causes of the three accidents.

However, the FAA changed its attitude after a special task force, the Engineering Test and Evaluation Board,[14] reported in July 2000 that it had detected 46 potential failures and jams in the 737 rudder system that could have catastrophic effects. In September 2000, the FAA announced that it wanted Boeing to redesign the rudder for all iterations of the 737, affecting more than 3,400 aircraft in the U.S. alone.[14]

Boeing agreed to redesign the rudder control system with a redundant backup and paid to retrofit the entire worldwide 737 fleet.[20] Following one of the NTSB's main recommendations, airlines were required to add four additional channels of information into flight data recorders in order to capture pilot rudder pedal commands, and the FAA set a deadline of August 2001 for airlines to comply.[21]
   ____________________________________

Peter Robinson, flying blind : the 737 max tragedy and the fall of boeing, 2021
p.39
two crashes
737-200 in Colorado Springs in 1991
737-300 near Pittsburgh in 1994
faulty rudder design
a single-paneled rudder
The crashes had been the result of a faulty rudder design.
[a single-paneled rudder design] lacked a device called a limiter, which made the plane more vulnerable to what's known as a hardover, an uncommanded deflection that appeared to happen only in extremely rare circumstances, such as when microscopic bits of grit got stuck in a valve.

p.181
In the wrangling over the Boeing rudder design blamed for two crashes back in the 1990s, litigation had eventually turned up a memo titled “We have a problem”, in which engineers acknowledged ── even before a second crash ── that a rudder valve had the potential to jam.   Some pilots had seen the anguish it caused colleagues who were asked to explain themselves years later, and they became more careful about what they put in writing.

   ── “We have a problem”, in which engineers acknowledged that a rudder valve had the potential to jam.

   (Flying blind : the 737 max tragedy and the fall of boeing / peter robinson.
new york : doubleday, 2021, bibliographical references and index., (ebook), (hardcover), (trade paperback), (ebook), boeing company──management.|boeing 737 (jet transport)──accidents.|aircraft industry──united states──management.|aircraft industry──united states──employees.|corporate culture., HD9711.U63 (ebook), 338.7/6291300973──dc23, 2021, )
   ____________________________________
 • Rudder function
   ── single rudder panel and single rudder actuator
   ── rudder actuator
   ── The single rudder panel is controlled by a single hydraulic Power Control Unit (PCU).
   ── hydraulic Power Control Unit (PCU)
   ── Inside the PCU is a dual servo valve that, based on input from the pilot's rudder pedals or the aircraft's yaw damper system, directs the flow of hydraulic fluid in order to move the rudder.
   ── servo valve, rudder pedals, yaw damper system, hydraulic fluid  
   ── designed by Boeing
   ── manufactured by Park Hannifin.
   ____________________________________

aircraft cargo-door failure

 
Aircraft type    McDonnell Douglas DC-10-10
 • Cargo door failure due to design flaw leading to rapid decompression
   ── June 12, 1972
   ── https://en.wikipedia.org/wiki/American_Airlines_Flight_96
   ── redesign of the rear-cargo door to open outward, in order to have more storage space in the cargo area ─ the door in passenger area of the aircraft has inward opening door; with inward opening door, when the aircraft is pressurized, it would be near impossible to open the door without depressurizing the aircraft.
   ── rear-cargo door would fail, causing rapid decompression, which would cause floor failure, resulting in severing the underfloor cables, compromising and  destroying the ability to control the aircraft.    

Aircraft type    McDonnell Douglas DC-10-10
 • Cargo door failure due to aircraft design flaw leading to explosive decompression, destruction of control systems, and loss of control
   ── 3 March 1974
   ── https://en.wikipedia.org/wiki/Turkish_Airlines_Flight_981
   ── March 3 – Turkish Airlines Flight 981, a McDonnell Douglas DC-10, crashes in the Ermenonville forest near Senlis, France, after the rear underfloor cargo door opens in mid-flight; all 346 on board die.
   ──
   ── The cargo door design flaws, and the consequences of a likely aircraft floor failure in the event of in-flight decompression on the DC-10, had been noted by Convair engineer Dan Applegate in a 1972 memo.[14] The memo was written after American Airlines Flight 96, being operated by another DC-10, experienced a rear cargo door failure similar to the one that occurred on Flight 981, also causing an explosive decompression. Fortunately, even though the pilots' ability to control Flight 96 was compromised by some severed underfloor cables in the damaged section of the plane, they were able to land in Detroit without further injuries – though Applegate warned that a more severe outcome was likely when (not if) a similar incident happened on another DC-10.

Aircraft type Boeing 747-100
 • Cargo door failure resulting in an explosive decompression in mid-flight.
   ── February 24, 1989
   ── https://en.wikipedia.org/wiki/United_Airlines_Flight_811
   ── on February 24, 1989, United Airlines Flight 811, a 747-100, N4713U, which suffered an explosive decompression in mid-flight. killing 9 of 355.
   ── N4713U
   ──
   ── Based on the evidence available, and the attribution of prior cargo-door malfunctions to damage and ground crew mishandling, the NTSB operated from an assumption that a properly latched and locked 747 cargo door could not open in flight:[10]: 37 
   ── N4713U:  the NTSB learned that in N4713U's case, the aircraft had experienced intermittent malfunctions of its forward cargo door in the months prior to the accident.[10]: 51 
   ──  Focusing on damage to the door and maintenance procedures, the NTSB concluded that the accident was preventable human error, and not a problem inherent in the design or function of the aircraft's cargo door.
   ── Lee Campbell, a New Zealander returning home, was one of the fatalities on Flight 811. After his death, his parents Kevin and Susan Campbell investigated the cause using documents obtained from the NTSB.[12] The Campbells' investigation led them to conclude that the cause of the accident was not human error, but rather the combination of an electrical problem and an inadequate design of the aircraft's cargo door-latching mechanism. They later presented their theory to the safety board.[13]
   ── On September 26 and October 1, 1990, two halves of Flight 811's cargo door were recovered from the Pacific Ocean from 14,100 feet (4,300 m) below the ocean surface. The cargo door had fractured lengthwise across the center. ([ why would a cargo door fractured lengthwise across the center, why not a completely intacted cargo door broken off at the hinge (mobile attachment mechanism to the fuselage) ])  Recovery crews reported that no other debris or evidence of human remains had been discovered.[17] The NTSB inspected the cargo door and determined that the condition of the locking mechanism did not support its original conclusions. [1]: vi 
   ── Additionally, in 1991, an incident occurred at New York's John F. Kennedy International Airport involving the malfunction of a United Airlines Boeing 747 cargo door.[18]
   ── https://www.ntsb.gov/doclib/recletters/1991/a91_83_84.pdf
   ──
https://web.archive.org/web/20121008002504/https://www.ntsb.gov/doclib/recletters/1991/A91_83_84.pdf
   ── [[ plot point for a movie: a circuit-breaker trip, an inadvertent operation of the electric door latch mechanism caused the ... door to open spontaneously despite being closed. ]]
   ── In the process of diagnosing the cause of a circuit-breaker trip, an inadvertent operation of the electric door latch mechanism caused the cargo door to open spontaneously despite being closed.  An inspection of the door's electrical wiring discovered insulation breaches, and isolating certain electrical wires allowed the door to operate normally again.[1]: 66–68 
   ── The lock sectors, latch cams, and latch pins on the door were inspected, and did not show any signs of damage of the type predicted by the NTSB's original hypothesis.[1]: 68 
   ──
   ── Final conclusions
   ── Based on developments after it issued its original report in April 1990, the NTSB issued a superseding accident report on March 18, 1992.[1]: 1–2  In this report, the NTSB determined that the probable cause of the accident was the sudden opening of the cargo door, which was attributed to improper wiring and deficiencies in the door's design. It appeared in this case that a short circuit caused an unordered rotation of the latch cams, which forced the weak locking sectors to distort and allow the rotation, thus enabling the pressure differential and aerodynamic forces to blow the door off the fuselage; ripping away the hinge fixing structure, the cabin floor, and the side fuselage skin; and causing the explosive decompression.[8]
   ── the weakest link principle (Murphy's law): improper wiring ==> short circuit ==> ? ciruit breaker trip ? ==> unorder rotation of the latching cams ==> weakening of the locking mechanism ==> pressure differential ==> blow the cargo door off the fuselage ==> ripping away the hinge structure ==> ...
   ── Edward Aloysisu Mirchy, Jr. [1917-1990]:  “If there is more than one way to do a job, and one of those ways will end in disaster, then someone will do it that way.”──Brian Burrell, The words we live by [1997], pp.146─149
   ____________________________________
 ── takes about two decades to fix known problem;
 ── the ... industry can resist fixing the root cause of known problem for about two decades;

 ── more like a function of tomestone technology;
 ── for some problems to be fixed, enough people have to die, the information has to be made public, and the investigative journalists/reporters have to tell a compelling story to exceed a minimum threshold in repetition, exposure, and ... to start the ball rolling;
 ── it also takes about two decades for enough people to die and enough cases to build up to make a compelling pressure for changed; would be nice if we can do better; ...
 ── however, if the industry like (1) Tobacco & cigarrete with cancer [United States][interesting because of UK healthcare system, they did not have this problem], (2) Petroleum & Fossil fuel industry with global warming, and (3) Chemical company with a insecticide [European union], the Industry can delay change for over two decades, stay in business, maintain the revenue stream, and accumulate the body count; ...
 ── the three cases, four cases if you add aircraft industry, fit the classic principle of concentrated benefit over diffuse harm; the industries gain concentrated benefit if they can delay change, and the harm is diffuse, making situation difficult for the Public, the Regulator, the Law, and the Representatives to gather enough evidence to implement change, without falling into false positive diagnosis (thinking the industry has screw up, when in fact, they did not).
 ── the industry is focus, determine, have the incentive to delay and maintain steady-state to not rock the boat, keep the gravy train running;
 ── yes, you will make less money, but guess what, you are preventing all the suffering, saving all those lives that does not have to die, and you are not going to get that bonus; hmmm ...
     ____________________________________
concentrated benefit over diffuse harm

        Written by John W. Gofman and Egan O'Conner  *14

([ --> principle of concentrated benefit over diffuse harm <-- ])

            “The law of Concentrated Benefit over Diffuse Injury can be stated as follows:

                “A small, determined group, working energetically for its own narrow interests, can almost always impose an injustice upon a vastly larger group, provided that the larger group believes that the injury is "hypothetical," or distant-in-the-future, or real-but-small relative to the real-and-large cost of preventing it.  

                [...]

                “Many scholars have written about this extremely important axiom before —— it is not original with us. The fact that narrow special interests are always at work for their own benefit at the expense of others is not at all surprising, given human nature. And it is not surprising that the victims select what appears to be the strategy of least cost to themselves.
                “The surprising aspect is the failure of so many victims —— especially in peaceful democracies —— to appreciate the aggregate consequences which inevitably accrue, when each small injustice has such a high chance of prevailing.”    

*14  (
       http://www.ratical.org/radiation/CNR/CBoDI.html
         )
   ____________________________________
 --> principle of concentrated benefit over diffuse harm <--  
   ____________________________________
John Bartlett.──17th ed., Bartlett's familiar quotations, 2002
p.852:10
p.852
10    “Murphy's Law”: if something can go wrong, it will.
          saying [1950s]3
          3  included in Arthur Block's collection of popular saying, Murphy's Law [1977].  In its original form [1949] by Edward Aloysisu Mirchy, Jr. [1917-1990]:  “If there is more than one way to do a job, and one of those ways will end in disaster, then someone will do it that way.”──Brian Burrell, The words we live by [1997], pp.146─149

   ( Bartlett's familiar quotations : a collection of passages, phrases, and proverbs traced to their sources in ancient and modern literature / John Bartlett; edited by Justin Kaplan.──17th ed., rev. and enl., 1. quotation, English, PN6081.B27  1992, 808.88'2──dc20, 2002, )
   ____________________________________

Peter Robinson, flying blind : the 737 max tragedy and the fall of boeing, 2021

pp.30-31
p.30
The first crash of one of the new fully loaded wide-body planes was an international scandal, provoking newspaper coverage of shocking design lapses, televised congressional hearings, and even a full-length book exposé.  Soon after the plane's takeoff from Paris Orly airport in March 1974, an explosion blew out the cargo door, buckling the floor and severing hydraulic lines.  All 346 people aboard died when the plane plunged into Ermenonville forest outside Paris, the worst airliner crash in history at the time.  Debris was scattered for half mile through wooded trails popular with Sunday hikers.
   The plane was a DC-10, a slightly smaller wide-body McDonell Douglas had developed to keep up with Boeing's 747.

https://en.wikipedia.org/wiki/Turkish_Airlines_Flight_981

March 3 – Turkish Airlines Flight 981, a McDonnell Douglas DC-10, crashes in the Ermenonville forest near Senlis, France, after the rear underfloor cargo door opens in mid-flight; all 346 on board die.

p.30
To save valuable interior cargo space, they broke with industry convention by designing a door that opened outward.  

pp.30-31
   It emerged that Douglas engineers had known the design was vulnerable to catastrophic failure, and indeed, two years earlier, a near disaster had ensued on a flight over Windsor, Ontario, which also lost a cargo door.  The pilot had been able to land the plane in that case.
p.30
..., Mr. Mac holding the purse strings as tightly as ever.  
p.31
Instead of fixing the issue immediately, McDonnell Douglas had convinced the FAA to let it add a support plate over time to the doors ── a “gentlemen's agreement” revealed in the congressional hearings.  Records at Douglas showed that the support plate had been added to the Turkish airlines plane, when it had not.  Three company inspectors had signed off on the nonexistent fix.  

   (Flying blind : the 737 max tragedy and the fall of boeing / peter robinson.
new york : doubleday, 2021, bibliographical references and index., (ebook), (hardcover), (trade paperback), (ebook), boeing company──management.|boeing 737 (jet transport)──accidents.|aircraft industry──united states──management.|aircraft industry──united states──employees.|corporate culture., HD9711.U63 (ebook), 338.7/6291300973──dc23, 2021, )
   ____________________________________
McDonnell Douglas DC-10 flight over Windsor, Ontario
<< look up this near disaster flight >>
https://en.wikipedia.org/wiki/American_Airlines_Flight_96

Date    June 12, 1972
Summary    Cargo door failure due to design flaw leading to rapid decompression
Site    Airspace above Windsor, Ontario
Aircraft type    McDonnell Douglas DC-10-10

The rapid decompression in the cargo hold caused a partial collapse of the passenger compartment floor, which in turn jammed or restricted some of the control cables which were connected to various flight control hydraulic actuators. The jamming of the rudder control cable caused the rudder to deflect to its maximum right position. The control cables to the number two engine in the tail were severed, causing that engine to shut down.[1] There was no rupture of any hydraulic system, so the pilots still had control of the ailerons, the right elevator, and the horizontal stabilizer.

The cause was traced to the cargo door latching system, which had failed to close and latch the door completely without any indication to the crew that it was not safely closed. A separate locking system was supposed to ensure this could not happen but proved to be inadequate. McDonnell Douglas instituted a number of minor changes to the system in an attempt to avoid a repeat. These were unsuccessful, however; on March 3, 1974, the rear cargo door of Turkish Airlines Flight 981 experienced the same failure and blew open, causing the aircraft to lose all control and crash in a forest near Paris, France. This crash killed all 346 people on board, making it the deadliest in aviation history until the 1977 Tenerife airport disaster and the deadliest single-aircraft crash until the 1985 crash of Japan Airlines Flight 123.[3]

In the cabin, the flight attendants saw a "fog" form within the cabin and immediately recognized it as a depressurization.

 It happened that while training to convert his expertise to flying the DC-10, McCormick had practiced, in a simulator, controlling the plane with the throttles in this fashion, in the worst-case scenario of a hydraulic failure.[2] A similar technique was used on another DC-10 in 1989 following a complete loss of hydraulic pressure on United Airlines Flight 232.[6]

The cabin floor failure was also a matter of poor design. All of the other portions of the cargo holds had holes cut into the cabin floor above the cargo areas. In the case of a pressure loss on either side of the floor, the air would flow through the vents and equalize the pressure, thereby eliminating any force on the floor. Only the rearmost portion of the cabin lacked these holes, and it was that portion that failed. Because the control cables were running through the floor for the entire length of the aircraft, however, a failure at any point on the floor would cut controls to the tail section.
   ____________________________________

Douglas engineers had known the design was vulnerable to catastrophic failure, and indeed, two years earlier, a near disaster had ensued on a flight over Windsor, Ontario, which also lost a cargo door.  The pilot had been able to land the plane in that case.

https://en.wikipedia.org/wiki/List_of_accidents_and_incidents_involving_commercial_aircraft#1974

https://en.wikipedia.org/wiki/Turkish_Airlines_Flight_981
Date    3 March 1974
Summary    Cargo door failure due to aircraft design flaw leading to explosive decompression, destruction of control systems, and loss of control
Site    Ermenonville Forest, Fontaine-Chaalis, Oise, France
Aircraft type    McDonnell Douglas DC-10-10

March 3 – Turkish Airlines Flight 981, a McDonnell Douglas DC-10, crashes in the Ermenonville forest near Senlis, France, after the rear underfloor cargo door opens in mid-flight; all 346 on board die.
 
Just after the aircraft passed over the town of Meaux, the rear left cargo door blew off and the sudden difference in air pressure between the cargo area and the pressurized passenger cabin above it, which amounted to 36 kPa (5.2 psi),[9]: 44  caused a section of the cabin floor above the open hatch to separate and be forcibly ejected through the open hatch,

When the door blew off, the primary as well as both sets of backup control cables that ran beneath the section of floor that blew out were completely severed, destroying the pilots' ability to control the plane's elevators, rudder, and number two engine. The flight data recorder showed that the throttle for engine two snapped shut when the door failed.[9]: 26  The loss of control of these key components resulted in the pilots losing control of the aircraft entirely.

The Lloyd's of London insurance syndicate that covered Douglas Aircraft retained Failure Analysis Associates (now Exponent, Inc.) to also investigate the accident. In the company's investigation, it was noted that during a stop in Turkey, ground crews had filed the cargo door's locking pins down to less than a quarter of an inch (6.4 millimetres), when they experienced difficulty closing the door. Subsequent investigative tests proved the door yielded to approximately 15 psi (100 kPa) of pressure, in contrast to the 300 psi (2,100 kPa) that it had been designed to withstand.[13]

The cargo door design flaws, and the consequences of a likely aircraft floor failure in the event of in-flight decompression on the DC-10, had been noted by Convair engineer Dan Applegate in a 1972 memo.[14] The memo was written after American Airlines Flight 96, being operated by another DC-10, experienced a rear cargo door failure similar to the one that occurred on Flight 981, also causing an explosive decompression. Fortunately, even though the pilots' ability to control Flight 96 was compromised by some severed underfloor cables in the damaged section of the plane, they were able to land in Detroit without further injuries – though Applegate warned that a more severe outcome was likely when (not if) a similar incident happened on another DC-10.

Although French media outlets called for Mahmoudi to be arrested, the crash investigators stated that it was unrealistic to expect an untrained, low-wage earning baggage handler, who could not read the warning notice, to be responsible for the safety of the aircraft.

This possibility of catastrophic failure as a result of this overall design was first discovered in 1969 and actually occurred in 1970 in a ground test, both of which McDonnell-Douglas knew about. This information, and the 1972 "Applegate Memo", came to light in the material supplied to the litigants after the 1974 crash.[16] McDonnell-Douglas had ignored these concerns, because rectification of what Douglas considered to be a small problem with a low probability of occurrence would have seriously disrupted the delivery schedule of the aircraft, likely causing Douglas to lose sales.

Additionally, the FAA ordered further changes to all aircraft with outward-opening doors, including the DC-10, Lockheed L-1011, and Boeing 747. These changes included requiring vents be cut into the cabin floor to allow pressures to equalize in the event of a blown-out door, thus preventing a catastrophic collapse of the aircraft's cabin floor and other structures that could damage the control cables for the engine, rudder, and elevators.

Aircraft other than DC-10s have also suffered catastrophic cargo hatch failures. The Boeing 747 has experienced several such incidents, the most noteworthy of which occurred on United Airlines Flight 811 in February 1989, when a cargo hatch failure caused a section of the fuselage to burst open, resulting in the deaths of nine passengers who were blown out of the aircraft.[21]
   ____________________________________

https://en.wikipedia.org/wiki/United_Airlines_Flight_811
 • on February 24, 1989, United Airlines Flight 811, a 747-100, which suffered an explosive decompression in mid-flight. killing 9 of 355.

N4713U

The aircraft had been flying for 17 minutes,[1]: 25  as it was passing from 22,000 to 23,000 feet (6,700 to 7,000 m), when the flight crew heard a loud "thump", which shook the plane. [1]: 2

About a second and a half later, the forward cargo door blew off. It swung out with such force that it tore a hole in the fuselage. Pressure differentials and aerodynamic forces caused the cabin floor to cave in, and 10 seats (G and H of rows 8 through 12) were ejected from the cabin.[1]: 8 [8] All eight passengers seated in these locations were killed, as was the passenger in seat 9F. Seats 8G and 12G were unoccupied.[1]: 109 [8] A gaping hole was left in the aircraft, through which a flight attendant, Mae Sapolu in the business-class cabin, was almost blown out. Purser Laura Brentlinger hung on to the steps leading to the upper deck, and was dangling from them when the decompression occurred. Passengers and crew members saw her clinging to a seat leg and were able to pull her back inside the cabin, although she was severely injured.[8]

The debris ejected from the aircraft during the explosive decompression damaged the Number 3 and 4 engines.[1]: 4–8 

The NTSB looked to circumstantial evidence, including prior incidents that involved cargo doors. In 1987, Pan Am Flight 125, another Boeing 747, outbound from London Heathrow Airport, encountered pressurization problems at 20,000 feet (6,100 m), causing the crew to abort the flight and return to the airport.[1]: 57 [11] After the safe landing, the aircraft's cargo door was found to be ajar by about 1.5 inches (3.8 cm) along its ventral edge.

Based on the evidence available, and the attribution of prior cargo-door malfunctions to damage and ground crew mishandling, the NTSB operated from an assumption that a properly latched and locked 747 cargo door could not open in flight:[10]: 37 

N4713U
The NTSB learned that in N4713U's case, the aircraft had experienced intermittent malfunctions of its forward cargo door in the months prior to the accident.[10]: 51 

 Focusing on damage to the door and maintenance procedures, the NTSB concluded that the accident was preventable human error, and not a problem inherent in the design or function of the aircraft's cargo door.

Lee Campbell, a New Zealander returning home, was one of the fatalities on Flight 811. After his death, his parents Kevin and Susan Campbell investigated the cause using documents obtained from the NTSB.[12] The Campbells' investigation led them to conclude that the cause of the accident was not human error, but rather the combination of an electrical problem and an inadequate design of the aircraft's cargo door-latching mechanism. They later presented their theory to the safety board.[13]

The Boeing 747 was designed with an outward-hinging door, unlike a plug door which opens inward and jams against its frame as the pressure drops outside, making accidental opening at high altitude impossible. The outward-swinging door increases the cargo capacity, but requires a strong locking mechanism to keep it closed. Deficiencies in the design of wide-body aircraft cargo doors were known since the early 1970s from flaws in the DC-10 cargo door.[14][15] These problems were not fully addressed by the aircraft industry or the NTSB, despite the warnings and deaths from the DC-10 accidents[16] and attempts by Boeing to solve the problems in the 1970s.[failed verification]

On September 26 and October 1, 1990, two halves of Flight 811's cargo door were recovered from the Pacific Ocean from 14,100 feet (4,300 m) below the ocean surface. The cargo door had fractured lengthwise across the center. Recovery crews reported that no other debris or evidence of human remains had been discovered.[17] The NTSB inspected the cargo door and determined that the condition of the locking mechanism did not support its original conclusions.[1]: vi 

Additionally, in 1991, an incident occurred at New York's John F. Kennedy International Airport involving the malfunction of a United Airlines Boeing 747 cargo door.[18]

https://www.ntsb.gov/doclib/recletters/1991/a91_83_84.pdf
https://web.archive.org/web/20121008002504/https://www.ntsb.gov/doclib/recletters/1991/A91_83_84.pdf

In the process of diagnosing the cause of a circuit-breaker trip, an inadvertent operation of the electric door latch mechanism caused the cargo door to open spontaneously despite being closed.  An inspection of the door's electrical wiring discovered insulation breaches, and isolating certain electrical wires allowed the door to operate normally again.[1]: 66–68 

The lock sectors, latch cams, and latch pins on the door were inspected, and did not show any signs of damage of the type predicted by the NTSB's original hypothesis.[1]: 68 

Final conclusions[edit]

Based on developments after it issued its original report in April 1990, the NTSB issued a superseding accident report on March 18, 1992.[1]: 1–2  In this report, the NTSB determined that the probable cause of the accident was the sudden opening of the cargo door, which was attributed to improper wiring and deficiencies in the door's design. It appeared in this case that a short circuit caused an unordered rotation of the latch cams, which forced the weak locking sectors to distort and allow the rotation, thus enabling the pressure differential and aerodynamic forces to blow the door off the fuselage; ripping away the hinge fixing structure, the cabin floor, and the side fuselage skin; and causing the explosive decompression.[8]

 • American Airlines Flight 96 – rapid decompression caused by a cargo door malfunction
   https://en.wikipedia.org/wiki/American_Airlines_Flight_96
 • Turkish Airlines Flight 981 – explosive decompression caused by a cargo door malfunction
   https://en.wikipedia.org/wiki/Turkish_Airlines_Flight_981
 • Aloha Airlines Flight 243 – explosive decompression caused by metal fatigue in the fuselage
   https://en.wikipedia.org/wiki/Aloha_Airlines_Flight_243
 • British Airways Flight 5390 – explosive decompression caused by an improperly installed windscreen
   https://en.wikipedia.org/wiki/British_Airways_Flight_5390
 • 1975 Tân Sơn Nhứt C-5 accident – loss of control caused by failure of locking mechanism for the aft pressure door
   https://en.wikipedia.org/wiki/1975_T%C3%A2n_S%C6%A1n_Nh%E1%BB%A9t_C-5_accident
   ____________________________________
“the never-ending challenge” by H. G. Rickover
metals engineering quarterly
february, 1963
pp.1-6

Progress ── like freedom ── is desired by nearly all men, but not all understand that both come at a cost.  
   ... ... ...
   ... ... ...
  In any advancing society some elements will accept the advantages of life at a higher plateau yet ignore its obligations.  
   ... ... ...
   ... ... ...

What is needed is an atmosphere, a subtle attitude, an uncompromsing insistence on excellence, as well as a healthy pessimism in technical matters, a pessimism which offsets the normal human tendency to expect that everything will come out right and that no accident can be foreseen ── and forestalled ── before it happens.
   ... ... ...
   ... ... ...

   I submit we must progress, and we must pay the price of progress.  We must accept the inexorably rising standards of technology and we must relinquish comfortable routines and practices rendered obsolete because they no longer meet the new standards.
   This is our never-ending challenge.

metals engineering quarterly
february, 1963

Rickover's speech at the National Metal Congress
new york, 1962, “the never-ending challenge”

source:
https://www.slideshare.net/hammankd/neverendingchallengeasm
(access 2022-09-01, website up)

Theodore Rockwell., The rickover efffect : how one man made a difference / 1992,  
   (The rickover efffect : how one man made a difference / Theodore Rockwell.,  1. rickover, hyman george.,  2. nuclear submarines ── united states ── history.
3. admirals ── united states ── biography.,  4. united states.,  navy──biography, V63.R54R63  1992,  359.3'2574'092--dc20,  united states naval institute,  Annapolis, Maryland, 1992 )
   ____________________________________