Doors Better Left Closed: The crash of Dan-Air flight 240

An illustration of the final moments of Dan-Air flight 240. (AAIB)

On the 26th of June 1981, a Dan-Air cargo plane operating on behalf of the Royal Mail was cruising above England when the aircraft was rocked by a loud explosion, followed by an uncommanded pitch up. As the pilots struggled with a worsening control problem, they declared an emergency and made straight for the airport, hoping that their badly damaged plane would hold together. Unfortunately, it did not: less than two minutes after the explosion, the plane went out of control and broke apart in midair, its wings ripping away from the fuselage as it plunged toward the ground. All three crewmembers perished as the remains of the aircraft crashed to earth near the village of Nailstone in Leicestershire.

The cause of the crash, as Britain’s AAIB would discover only after extensive analysis of the wreckage, was almost too absurd to believe. It turned out that a badly designed baggage door had come open in flight, ripped off the fuselage, and wrapped itself around the horizontal stabilizer, crippling the pilots’ ability to control the pitch of their airplane. It was a case which was almost unique in aviation history, and which highlighted one of the principal issues with the over-engineered Hawker Siddeley HS-748 — the seemingly endless number of ways in which the plane’s various Rube Goldberg-esque mechanical systems could lead to completely unexpected problems.

Basic diagram of the Hawker Siddeley HS 748. (SKYbrary)

In the late 1950s, British aircraft manufacturer Avro designed what it hoped would be a worthy successor to the ubiquitous 1930s-era Douglas DC-3. The plan was for a twin-engine turboprop with room for around 40 passengers, the ability to take off on short, unimproved runways, and an overall ruggedness which would help it thrive in even the harshest climatic conditions. What they came up with was the Avro 748, a fascinating product which met all of the aforementioned requirements, but came with no small amount of bizarre quirks that would flummox mechanics and pilots alike for decades to come.

By the time the model first flew in 1960, Avro was a subsidiary of Hawker Siddeley, another British manufacturer, and except for the first few examples produced under the Avro brand before 1962, the type became known as the Hawker Siddeley HS 748. The plane sold reasonably well, especially overseas, becoming particularly popular in India and Latin America, where operators appreciated its ability to take off and land on short runways with primitive infrastructure.

G-ASPL, the aircraft involved in the accident. (Rob Hodgkins)

Relatively few HS 748s were sold in the United Kingdom, but of those which were, one of the biggest customers was Dan-Air, Britain’s largest low-cost carrier during the 1970s and 1980s. Dan-Air took delivery of at least 13 mostly pre-owned HS 748s, which it used to run a variety of unusual side operations in parallel to its main practice of running tourist charter flights to Europe. While some of its HS 748s were employed ferrying oil workers to and from major oil industry hubs in Scotland, Dan-Air used several others to perform nighttime mail runs on contract with the Royal Mail. For this purpose, Dan-Air had installed passenger seats which could be folded up against the walls, converting the cabin into a cargo area where pallets of mail were tied down with straps.

It turned out that with the plane fully loaded, there was no room for a gangway between the front and rear of the cabin, and anyone wishing to move from one end to the other had to literally crawl over the tops of the pallets. Because this significantly complicated the pilots’ ability to fight a fire on board the aircraft, Dan-Air employed a “Postal Assistant,” or PA, on each mail flight whose job was to sit in the back of the plane and watch out for a fire or any other sign that something was wrong with the cargo. This job typically went to college students looking for summer work, no doubt in part because 18-to-22-year-olds were nimble enough to crawl over all of the mail pallets whenever they wanted to speak to the pilots.

The route of Dan-Air flight 240 within England. (Google + own work)

It was one of these HS 748s, registered as G-ASPL, which arrived at London’s Gatwick Airport at 3:00 in the morning on the 26th of June 1981, having just completed a mail run. The crew left the plane and ground crews secured it for the night, making sure to close the two passenger doors on the left side and the baggage door on the right.

More than 12 hours later, ground crews returned to the plane to prepare it for its next trip, filling the cabin with pallets of mail bound for Castle Donington in Leicestershire, and several places beyond. The Postal Assistant, a 20-year-old student preparing to study aeronautical engineering and avionics, was the first member of the flight’s three-man crew to arrive, whereupon he restocked the galley with coffee, tea, soft drinks, and meals. The pilots, a 36-year-old Captain and 29-year-old First Officer, arrived shortly thereafter, and set about conducting routine pre-flight checks.

The layout of G-ASPL’s cabin. During the flight the PA would sit in the fixed double passenger seat. Take note of the location of the baggage door. (AAIB)

Besides watching for fires, the Postal Assistant was also responsible for checking that all the doors were properly closed and locked before takeoff. According to regulations extant at the time the plane was designed, the doors were required to open outward, a safety measure implemented in response to incidents in which crushes of panicked passengers during emergencies had left no room to operate inward-opening passenger doors. The advantage of an inward-opening door is that it can be larger than its frame, allowing the pressurized cabin air to force the door closed as the airplane climbs. Such a door is impossible to open in flight. In contrast, an outward opening door requires a complex locking system to counteract the effects of pressurization and keep the door closed. Modern airplane doors incorporate the best of both worlds, using an ingenious opening sequence which allows the door to open outward despite being bigger than its frame. But the HS 748, having been designed in the 1950s, predated this innovation, and its doors were held closed in flight by plain old mechanical locks.

The HS 748 was originally designed with a single locking mechanism: a set of claw-shaped latches, connected to the sides of the door, which grasp the doorframe and hold the door shut. To ensure that pressure on the door cannot back-drive the latches, each claw is attached via a mechanical linkage which moves “over center” when the door handle is driven to the fully closed position.

This diagram should help you envision what is meant by the linkages being “over-center.” (AAIB, with annotations)

The concept of over-centering is very common in mechanical engineering, especially when designing complex locking systems. When pressure is applied to a hinge, the angle formed by the hinge will decrease toward zero degrees, like a pair of scissors. It will not, however, increase past 180 degrees to close the other way, unless acted upon from the opposite direction. Moving the angle formed by the hinge past 180 degrees in this manner is called “over-centering.” Over-centering is useful in that the constant unidirectional application of pressure to the hinge cannot reverse it. In the case of the HS 748’s door locking mechanism, the hinge in the linkage attaching each claw to the door is designed such that when the linkage is over-centered, trying to close the angle formed by the hinge will drive the claw latches further toward the locked position, preventing the pressure on the door — and thus on the hinge — from causing the door to open. In contrast, when opening the door, operation of the door handle forces the hinge back across 180 degrees, at which point further closing of the hinge instead causes the claws to pull away from the doorframe, unlocking the door.

How the secondary locking mechanism insures that the linkages remain over-center. (AAIB, with annotations)

In theory, this system would be sufficient to prevent the door from opening in flight, as the pressure acting on the door from the inside should force the claw latches further closed. However, the system was not sufficiently reliable in practice, and throughout the 1960s Hawker Siddeley introduced a number of additional systems designed to add redundancy. The most significant was the addition of a secondary locking mechanism which drives “plungers” down in front of the claw linkages to prevent them from leaving the over-center position (as shown above). This secondary locking mechanism was also driven by the door handle, with a complicated cam system and a series of cables and springs ensuring that the primary and secondary locking stages always happened in the correct order.

Four other changes were also made to the door during this period. First, a pressure lock was installed, which would physically prevent the plungers in the secondary locking mechanism from moving back toward the unlocked position if the pressure difference between the inside and outside of the plane was above a certain value. Second, a warning system was installed which would cause a “door unsafe” light to illuminate in the cockpit if the secondary locking plungers were not in place on any of the three doors. Third, mechanical indicators were installed on each of the doors. The indicators consisted of rotating drums, visible through small windows, which were driven by the secondary locking plungers and would display green and yellow stripes when the plungers were locked and red when the plungers were unlocked. And finally, the use of the baggage door’s exterior locking handle was forbidden, as this particular handle had a nasty habit of not locking the door all the way even when it was moved to the fully closed position.

The mechanical door position indicators, with their internal mechanism (left) and how they should appear to an observer (right). (AAIB)

G-ASPL had all of these assurances against improper locking of any of the doors. If one of the doors wasn’t locked, the warning light in the cockpit would fail to extinguish, and if there was a problem with the light, the Postal Assistant could still spot a problem when he checked the mechanical indicators, which was part of his standard pre-flight duties. On this day, it seemed there were no problems with any of the doors, because the checks went smoothly and the pilots called for clearance to start their engines just three minutes later.

Operating as Dan-Air flight 240, G-ASPL left Gatwick Airport at 17:28, headed north toward East Midlands Airport in Castle Donington. The plane reached its cruising altitude of 10,000 feet and leveled off, proceeding on course and on schedule to reach its destination at 18:25.

At 17:57, the Postal Assistant shimmied his way across the mail pallets to the cockpit, popping in to ask the pilots if they would like anything to drink. They replied that they would, thank you very much, and the PA spent the next five minutes in the galley preparing a kettle of tea. By the time he served it at 18:02, the plane had already begun its descent into Castle Donington, and a normal landing seemed imminent.

But when the PA crawled back to his seat at the rear of the plane, he spotted something surprising: the mechanical indicators on the rear baggage door were showing red, indicating that the door was not properly locked. Aware of the significance of the indication, he hurried back to the cockpit, where he told the pilots, “The indicators on the rear port door are showing red!”

The baggage door was on the starboard side, not the port side, but the PA’s confusion was inconsequential; any door being unlocked, regardless of its location, was a serious problem.

“Showing red?” The Captain asked.

“Yeah, it looks as if the handles [several unintelligible words] on it are showing red, not normal,” the PA repeated, the cockpit voice recorder just barely picking up his indistinct voice in the background.

“Passenger door, sorry,” the Captain corrected.

“Yeah,” the PA agreed.

“Oh,” said the Captain.

3-D illustration of flight 240’s final minutes. (AAIB)

Flight 240’s captain had plenty of experience on the HS 748 and knew that he was facing a potential emergency. But he also knew what he had to do to mitigate the consequences if the door came open. He immediately leveled off and decreased speed in order to slow the plane, which would help minimize the damage if the door ripped off and struck the tail. He also told the PA to stay in the cockpit, since his usual seat was right next to both rear doors and he could be injured or killed if a door failed.

Sensing the plane level off, the First Officer asked, “Strong updraft?”

“No, the rear passenger door… port passenger door’s showing unlocked,” the Captain said, explaining that he was taking precautionary measures in case the door came open. He then ordered the First Officer to increase the rate of depressurization, hoping that the inside and outside air pressure could be equalized quickly, given their low altitude.

Several minutes later, flight 240 was cleared to descend from 6,000 feet to 3,000 feet and intercept the approach course into East Midlands Airport. Stabilized in a descent at 150 knots, the plane continued as normal for about a minute — until suddenly, at an altitude of 5,450 feet, all hell broke loose.

At that exact moment the rear baggage door abruptly unlatched, and the pressurized cabin air instantly blasted it straight off its hinges, triggering a loud explosion. The door flew outward momentarily, then fell back in the slipstream, where it slammed into the leading edge of the right horizontal stabilizer a split second later. But, remarkably, instead of bouncing off, the door folded perfectly in half around the leading edge of the stabilizer and became lodged firmly in place!

Flight data shows how the final loss of control unfolded. (AAIB)

Almost instantly, the plane pitched up and yawed to the right due to the massive increase in drag on the tail. The Captain reacted right away, pitching down and steering left with the rudder to keep the plane under control. Clearly aware that the door had separated and damaged the tail, he told his First Officer to declare an emergency, and just eleven seconds after the explosion he said to air traffic control, “We’d like to come straight in, we’ve had a violent depressurization and it looks as though we’ve lost our back door and having a severe control problem!”

With the door stuck on the horizontal stabilizer, airflow over the right elevator was severely disrupted, leading to difficulty controlling the pitch of the airplane. As the Captain attempted to push the plane into an emergency descent toward the airport, he found he had to use considerable force on the yoke to keep the aircraft from going out of control, and even so he was unable to stop it from entering a slow, continuous banked turn to the right. Urgent shouts and exclamations filled the cockpit and multiple calls from air traffic control went unanswered. The force required to keep the plane from pitching up was increasing toward the limits of his physical ability. And then, without warning, the plane suddenly pitched over to 24 degrees nose down, throwing the crew violently toward the ceiling. A split second later the plane pitched suddenly back up again to 6 degrees nose down, then returned to 16 degrees nose down, then violently reversed direction to 34 degrees nose up, all within the space of five seconds. The incredible G-forces induced by the maneuver fatally compromised the aircraft’s structure, and both wings ripped off simultaneously. Witnesses in a nearby village watched in horror as the HS 748 totally disintegrated in midair, its burning wings spiraling down out of the sky as the fuselage, containing the still-running flight recorders, plunged directly into the ground from a height of 900 feet. The fall was not a long one: three seconds after the breakup, the remains of the plane crashed to earth in a farmer’s field, instantly killing all 3 crewmembers.

Diagram of the relative positions of the main and ancillary wreckage fields. (AAIB)

◊◊◊

When investigators from Britain’s Air Accidents Investigation Branch arrived on the scene later that night, they found a complex crash site which raised more questions than it answered. The fuselage and wings had come down several hundred meters apart, both in agricultural fields outside the village of Nailstone in Leicestershire, a few kilometers short of East Midlands Airport. More parts, mainly from the tail, were scattered between them, along with the baggage door, which had seemingly been folded in half down the middle upon impact with a long, thin object. Pieces of the trim surrounding the baggage door were scattered throughout the area, as well as along a trail running beneath the plane’s flight path for some four kilometers leading up to the crash site. It was clear that something had happened to the door at around the time the in-flight emergency began.

The fact that the door was found at the main crash site and not at the point where the explosion occurred, combined with the nature of the impact damage and the presence of rubber deposits which matched the de-icing boots on the leading edge of the horizontal stabilizer, proved beyond any reasonable doubt that the door must have come free and then adhered to the stabilizer as it flew back in the slipstream. It was a bizarre finding, but the evidence was conclusive — somehow, the plane really had flown during its final minutes with a door wrapped around the stabilizer. The AAIB therefore had to answer two main questions: why did the door come open, and could it really have caused the pilots to lose control of the plane?

The remains of the fuselage where they came to rest in a field. (danairremembered.com)

To explore the latter question, investigators partnered with manufacturer British Aerospace to conduct a series of wind tunnel tests on an HS 748 tail with a representative door affixed to the right horizontal stabilizer. Although the test conditions could not exactly match those encountered on the actual flight, they did reveal that the disruption to the airflow over the elevators as a result of the presence of the door would make the plane extremely difficult to control. Control was just barely possible at low speeds, but as the speed of the airplane increased, it would encounter an area of extreme pitch instability, where the turbulent airflow over the right elevator could cause the plane to rapidly pitch up and down in a completely uncontrollable manner. Indeed, this appeared to be what happened on flight 240. As the plane descended rapidly toward the airport for an emergency landing, its airspeed reached the zone of instability and control was lost, resulting in a sequence of increasingly violent pitch changes which exceeded the structural strength of the wings, leading to the breakup of the aircraft in flight. Not knowing anything about the danger — there was no procedure, nor could there be a procedure, for how to fly a plane with a door stuck to the tail — the Captain could not have avoided the zone of instability. In summary, the tests showed that from the moment the door adhered to the stabilizer, flight 240 was certain to crash.

That left the question of why the door came open in the first place. Here there were a number of odd aspects of the case that initially baffled investigators. There was no evidence of damage to the door which could have caused it to open, so the plane must have departed without the door having been properly latched and locked. But if this was the case, why did nobody notice during the pre-flight checks, and why did the door fail while the plane was descending? Logic dictated that an improperly closed door would come open during climb as the pressure differential increased, not at 5,450 feet on descent when the pressure differential was minimal. How was such a thing possible?

The effect of the two sets of latches becoming asynchronous. (AAIB)

By taking careful measurements of the remains of the door and conducting extensive testing, the AAIB was able to come to a remarkable conclusion about how and why it came open.

The story began with the rod which transfers motion of the door handles into the uppermost pair of claw latches on the baggage door. The length of this rod can be adjusted (likewise for the lower rod) in order to ensure that the two pairs of claw latches engage simultaneously. But on this particular door, the length of the upper rod had been adjusted incorrectly, causing the two sets of claws to become asynchronous: the linkages for the lower claws would move over-center before the linkages for the upper claws. As a result, when using the forbidden outside door handle, it was actually impossible to close the door properly as the upper linkages would not quite move over-center, and the secondary locking plungers would not move to the locked position, even when this handle was fully closed. It was possible to close the door properly using the inside handle, but extra force was required to push it the last few millimeters to over-center the upper linkages and deploy the plungers.

Although the cockpit and other parts of the plane were easy enough to identify, the impact was non-survivable. (danairremembered.com)

Considering the above, it was not hard at all to imagine that the last person to close the baggage door failed to close it all the way, locking only the lower claws, without over-centering the upper claws or engaging the plungers. The AAIB was not able to determine exactly who did this, but witnesses agreed that the baggage door was not used while loading the mail onto flight 240, so it was likely closed by ground crew personnel after the plane arrived from its previous flight at 3:00 that morning. If this were the case, the person who closed the door may not have known that use of the outside handle was forbidden, or that they needed to use extra force to close the inside handle all the way.

Once this had occurred, neither the position of the handle nor the positions of the claws would have revealed the fact that the door was not properly locked. Over-centering the linkages does not appreciably change the position of the claws, and the inside handle would have been displaced only a few millimeters from the fully closed position. Because the linkages and plungers were not directly visible either, the crew of flight 240 would therefore have relied on the mechanical indicators and the cockpit warning light to determine whether the door was safe.

In theory, the cockpit warning light should have informed the pilots that the door was not locked, since the light would only extinguish when the plungers were fully extended, which they were not. What indication the pilots received, and whether they properly checked it, could not be determined because the cockpit voice recorder only recorded the last 30 minutes of the flight. The AAIB did note, however, that it was legal to take off with the light illuminated, as long as the positions of all the doors were verified by other means. If this had occurred, there should have been some extra time taken to decide a course of action and verify that the doors were locked, but the established timeline did not allow for such a possibility. In fact, the pilots called for startup clearance only three minutes after beginning their pre-start checks, a process which would have required the entire three minutes, leaving no room for any unexpected conversations to have taken place.

Alternatively, the AAIB could not rule out the possibility that a short circuit cut the baggage door out of the loop and caused the light to extinguish regardless of the door’s actual status, but this theory could not be proven because not all of the wiring was found after the crash. It also could not be ruled out that the pilots never checked the status of the light in the first place, but there was no evidence for this theory either.

How various factors affected the readability of the mechanical indicators. (AAIB, with annotations)

The only remaining means to alert the crew to the problem was the pair of mechanical indicators on the bottom of the door. But these would not have been a silver bullet either. Despite the fact that the condition of the door was a binary state — it was either locked, or it was not — the mechanical indicators used rotating drums that were driven progressively by the secondary locking plungers. In this case, the plungers would have been driven part way home, only to run into the upper claw linkages that were not over-centered. This meant that the mechanical indicators would have been driven part way to the “safe” position as well, showing approximately half red (unsafe) and half green/yellow stripes (safe).

But a number of confounding factors made this indication even more misleading. Most notably, on G-ASPL the viewing windows over the mechanical indicators had been installed inside-out. The windows have a curved surface which is supposed to sit almost flush against the drums, with the convex side facing outward. However, it is possible to install the windows the other way around, with the concave side facing outward, and this is how it was done on G-ASPL. Had the windows been installed correctly, they would have made contact with the face of the drums, creating friction which would cause the drums to move to the “safe” position more slowly. But with the windows the wrong way around, there was no friction between the window and the drum, allowing gravity to pull the drums farther toward the “safe” position than they would otherwise rest.

Additionally, the red areas as originally installed were not large enough, so part of the bottom of the green and yellow “safe” indication had been painted over in red. However, over the years this red paint had worn away, revealing some of the original green and yellow stripes which were not supposed to be visible, and blurring the boundary between the two zones. Furthermore, viewing the drums through the concave side of the window — the result of the incorrect installation — created a parallax effect which would distort the appearance of the indication, possibly hiding the strip of red which should have remained at the bottom even after accounting for all of the above. And as if that wasn’t enough, the area around the baggage door was very poorly lit, and the optimal viewing position placed the viewer in between the indicators and the nearest light source, casting a shadow which made them even more difficult to see.

An investigator retrieves the flight recorders from the crashed airplane. (danairremembered.com)

As a result of all of these factors, when the Postal Assistant looked down at the mechanical indicators, squinting to make out anything in the dim light, he could very well have seen two green and yellow “safe” indications, leading him to believe that the door was properly closed and locked. Investigators proved this in practice by simulating the conditions, and found that the unsafe status of the door could only be discerned by closely examining the indicators up close with a flashlight. It was thus plainly obvious how the PA could have failed to notice that the door was unsafe.

Subsequently, the plane took off with neither the upper claw linkages over-center nor the secondary locking plungers engaged. The barometric lock also could not engage unless the plungers were engaged first, so it too was useless. Therefore the only thing holding the door closed was the fact that the two bottom linkages were over-centered.

In this condition, the door was highly unstable, because the pressure acting on the door would tend to force the upper claws open and the lower claws closed, and it was anyone’s guess which would prevail. To find out, the AAIB ran a pressurization test on a representative door. Their conclusions were surprising: although the door managed to remain closed throughout the climb and cruise phases when the pressure was highest, the removal of pressure as the plane descended would tip the balance just enough for the upper claws to overpower the lower ones and open the door. In fact, when a pressure of 3.0 psi, equivalent to that experienced at 10,000 feet, was applied to the door, the lower claws would be pushed far enough toward the locked position to secure the door, but when the pressure was relaxed to 1.0 psi, the lower claws would move 0.1 millimeters back toward the unlocked position, and the door would instantly come open. Aerodynamic forces would have immediately ripped the open door off its hinges and hurled it against the stabilizer, leading to the accident. Even though the PA noticed the true position of the mechanical indicators shortly before the door failed, his warning came too late to halt this strange and deadly sequence of events.

The intact cockpit belied the violence of the crash, which killed all three crewmembers instantly. (danairremembered.com)

By this point it had become clear that the design of the HS 748’s baggage door played a central role in the crash, as its overly complicated and finicky mechanisms failed in numerous ways that were not detectable by anyone. Investigators took issue with numerous design decisions, including that the position of the claws did not indicate whether their linkages were over-center; that a progressively rotating drum indicator was used to display a binary status; and that a single warning light was used for all three doors, making it hard to tell which door was not closed. The AAIB was therefore not terribly surprised to learn from Hawker Siddeley that the HS 748 baggage doors actually came open in flight on a fairly regular basis.

In total, there were 35 such incidents reported to the manufacturer between 1962 and 1981, almost all of which occurred overseas. In nearly every case, the door came open shortly after takeoff; flight 240 was unique in that it came open on descent. However, 13 of the cases did involve the door separating from the airplane entirely, and in five cases it subsequently struck and damaged the tail. In fact, in two of those cases, the door even became stuck on the horizontal stabilizer, just like on Dan-Air flight 240. In one case in 1962, the pilot managed to make a successful forced landing and no one was injured; in the second incident, which happened in 1968, the plane was also able to turn around and make a successful emergency landing. In both incidents, despite control difficulties, disaster was avoided because the failure occurred during initial climb when the airspeed was well below the zone of pitch instability.

This photo appears to show the baggage door as it was found after the crash. (danairremembered.com)

Besides the cases in which the baggage door actually came open in flight, the entire HS 748 fleet also suffered from constant minor door problems that had become the bane of flight crews around the world. The cockpit warning light was constantly coming on for unclear reasons; doors frequently became stiff to operate or had trouble closing; and seals around the doors leaked on a regular basis. Almost every HS 748 maintenance log was full of such problems, including the log belonging to G-ASPL, which had dozens of door-related entries.

The sheer number of incidents and other problems involving this door was unusual, and should have alerted Hawker Siddeley to the fact that something was wrong with its particular design. The AAIB noted that although the baggage door and the passenger doors had similar designs, the passenger doors had six claw latches while the baggage door had only four, making the latter much more likely to open if one pair of claws was not properly locked. Nevertheless, the manufacturer never figured this out on its own, and never attempted to find a better design which would solve the constant recurring problems. The AAIB noted that this was probably because the incident reports were received by non-standard means, often when airlines contacted Hawker Siddeley to ask for new doors, and most of the events occurred overseas in places with poor documentation. Furthermore, the fact that the reports were spread over two decades in service may have masked the trend. During much of this time there was no requirement to report door problems to the UK Civil Aviation Authority, and even after such a requirement was instated in 1976, only two incidents made it into the database which the CAA used to identify safety trends involving British-made aircraft.

The AAIB’s final report on the accident was issued in May 1983. (AAIB)

As a result of the accident, the manufacturer made a number of changes to the design of the HS 748’s baggage door. A new cam was installed which made it impossible to close the door from the outside; decals were added to the door to show what a correct “door safe” indication should look like; the viewing windows were redesigned to reduce the risk of being installed backwards; the microswitches were upgraded to improve the reliability of the “door unsafe” warning light; and a number of bulletins were issued to operators explaining the vulnerabilities uncovered during the investigation. Although the overall design didn’t fundamentally change, the measures were sufficient to prevent a repeat accident, even if they didn’t conclusively reverse the door’s reputation for unreliability.

Some of the diagrams used to illustrate the equally complex crash of Dan-Air flight 0034, another Hawker Siddeley HS 748. (Original diagrams by AAIB)

If your impression thus far is that the Hawker Siddeley HS 748 was absurdly overengineered, you would not be far off the mark. Anecdotally, its various needlessly complicated systems were objects of ridicule for mechanics and pilots alike. And this was not the only time that these quirks led to tragedy: most significantly, in 1979 Dan-Air flight 0034, another HS 748, ran off the end of a runway in the Shetland Islands and crashed into the North Sea, killing 17 people. The cause of the crash was a poorly designed cockpit lever, whose various flaws, too numerous to list here, led to the re-engagement of the gust locks — which hold the elevators in the full nose-down position while the plane is parked — after the pilots had already performed their before-takeoff control checks. Much like the case of Dan-Air flight 240, the crash of Dan-Air flight 0034 was all but unique in aviation history. Indeed, although it was not uncommon for planes of that era to suffer from a wide range of quality issues, the specific problems which afflicted the HS 748 ranged at times from bizarrely obscure to downright weird. For the handful of pilots who fly the half dozen or so HS 748s still in service today, the plane’s design is surely a constant source of both amusement and concern. After all, unpredictability may be a sign of well-written comedy, but its value in airplane design is rather more questionable.

_________________________________________________________________

Join the discussion of this article on Reddit!

Visit r/admiralcloudberg to read and discuss over 200 similar articles.

You can also support me on Patreon.

--

--

--

Analyzer of plane crashes and author of upcoming book (eventually™). Contact me via @Admiral_Cloudberg on Reddit or by email at kylanddempsey@gmail.com.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Churchill or Hitler: The Indian Choice!

Stories from a Tower of Faces: The Rabbi

About Atlantis

The crash of BOAC flight 911: Analysis

Sarah Bernhardt’s Initiation …

The Dust Settles.

The New Americans: Immigrants Who Served

Desiderata —

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Admiral Cloudberg

Admiral Cloudberg

Analyzer of plane crashes and author of upcoming book (eventually™). Contact me via @Admiral_Cloudberg on Reddit or by email at kylanddempsey@gmail.com.

More from Medium

Famous Author Ernest Hemingway’s Brush With Death From Flushing A Toilet

Holodomor…Redux?

A Brief History of American Fallout Shelters

The Wonderful World of Completely Random Facts — Issue 44