The Missing Bolts from Alaska Airlines flight 1282
On the 5th of January 2024, Alaska Airlines flight 1282 had just taken off when it lost a door plug, leaving a gaping hole on the left side of row 26. I wrote about the incident that week.
The NTSB released a four-minute video of the investigators on the aircraft and I found it interesting to see them in action.
The NTSB invited the following to take part in the investigation: Alaska Airlines, Air Line Pilots Association (ALPA), Association of Flight Attendants – CWA (AFA-CWA), Federal Aviation Administration (FAA), the Boeing Company (Boeing), Spirit AeroSystems, and the International Association of Machinists Union (IAM).
The inclusion of the Machinists Union is interesting.
On the 5th of February, the NTSB issued their preliminary report, which I’d like to look at in more detail today.
So let’s get the easy stuff out of the way: the crew were perfectly qualified. Nothing was visibly wrong with the aircraft during the pre-flight inspection that they should have caught.
The captain was the Pilot Flying as they departed Portland and were cleared to climb to FL230 (23,000 feet). There were 171 passengers and four cabin crew on board.
About six minutes into the flight, as they climbed through 16,000 feet, the flight crew heard a loud bang and their ears popped. The flight deck door burst open. The captain’s head fell forward with his headset pushed up nearly off his head. The first officer’s headset came off completely. They both immediately put on oxygen masks.
A warning activated as the cabin altitude exceeded 10,000 feet. Normally, the maximum cabin pressure altitude remains around 8,000 feet as the aircraft climbs. The differential pressure dropped to 5.7 psi and rapidly decreased to nothing over the course of a few seconds. The aircraft continued to climb for another minute and then began to descend.
In the cabin, a door-sized gap appeared on the aircraft’s left side. The window seat in row 26, which was thankfully unoccupied, had its back twisted forward and out towards the opening. The back of the window seat in row 25 was also twisted out and back. The sidewall panels in the aircraft buckled in the force of the initial decompression and the door frame of the lavatory was deformed.
A teenage passenger in the middle seat of row 26 had his phone and shirt torn away into the darkness while he was held in place by his seatbelt. His mother, sitting next to him in the aisle seat, grabbed him in terror. They quickly moved to free seats further up the aircraft.
The cockpit was noisy and difficult to communicate as the flight crew declared an emergency and requested a lower altitude. ATC immediately cleared the aircraft to descend to 10,000 feet. The captain requested the rapid decompression checklist, which the first officer executed.
A cabin crew member with a portable air canister rushed to the breach, quickly determining which passengers had been sat in row 26 and that they were still on board.
The warning deactivated about three and a half minutes later as the aircraft descended through 9,000 feet. They returned to Portland International and landed safely. Seven passengers and one cabin crew member were treated for minor injuries.
That leads us to the one clear mistake made by the flight crew. Neither pilot remembered to pull the CVR circuit breaker, meaning the cockpit voice recorder data was all overwritten.
Another issue, which may or may not be relevant, is that the maintenance logs showed that a warning light regarding pressure control had lit up on three flights before the incident. These warnings restricted the aircraft from long flights over water but was not necessarily connected to that day’s incident.
Alaska Airlines contacted all passengers the same day to refund the tickets, offering cash payments of $1,500 to cover any immediate needs, as well as access to counselling sessions and mental health resources. There were no stipulations attached to the payments.
It was immediately apparent that the breach was from a door plug. This structural panel fits into the frame of an unused door opening, but it had somehow detached twenty minutes into the flight, leading to an uncontrolled cabin decompression.
There are three types of uncontrolled decompression events, categorised by the speed at which the decompression occurs.
Explosive decompression is a decompression faster than your lungs can decompress, that is, less than half a second. Unsecured items fly through the aircraft and an eerie fog appears, a result of the rapid temperature change. The risk of lung trauma and death is high.
Rapid decompression takes place more slowly, although it surely doesn’t feel that way at the time. In this case, the uncontrolled decompression is slow enough for the lungs to decompress. A rapid decompression is still dangerous but likely to be survived by fitting an oxygen mask on quickly. The main risk, assuming you are not sitting in the seat next to the fuselage rupture, is hypoxia if you do not put on your oxygen mask, as your time of useful consciousness is severely limited.
When Southwest flight 812 suffered a fuselage failure in 2011, there were only two injuries: one was a cabin crew member who believed he had time to make a cabin announcement and talk to the flight crew before putting his mask on. When he fell unconscious, an off-duty airline employee let go of his mask in order to stand up and help him and then also fell conscious. Both came to as the aircraft descended but had suffered injuries in their falls.
The third category of uncontrolled decompression is gradual decompression. This is a slow and insidious decompression which is often only detectable by instruments.
The aircraft was a Boeing 737-9, serial number 67501, registered in the US as N704AL. Boeing designed the Boeing 737-900 to have optional mid-cabin emergency exits. Airlines with less passenger seating in the cabin who did not need the emergency exit could instead install a mid exit door plug (MED plug) which would block the unused emergency exit.
This isn’t a simple cost-saving decision. Installing the door plug saves weight, and thus fuel, as the plug weighs just 63 pounds compared to 150 pounds for the emergency door. The plug is also less complex than an emergency door, which means fewer issues with operations, maintenance and parts. There’s also the scenic advantage as passengers in the exit row get full-sized passenger windows. However, it also limits the number of passengers that the aircraft can carry.
The door plug was manufactured and installed by Spirit AeroSystems. Spirit AeroSystems is a US manufacturer of aircraft airframe components based in Wichita, Kansas. The plant was founded as Stearman Aircraft in 1927 before they were acquired by United Aircraft and Transport Corporate, William Boeing’s superlative Aerospace firm designed to serve all aviation markets. In 1934, after a governmental scandal regarding the awarding of air mail contracts to a select few airlines, United Aircraft and Transport Corporation was forced to separate aircraft manufacturing from air transportation businesses into three companies: United Airlines, United Aircraft Manufacturing Company and the Boeing Aircraft Company, which kept all manufacturing interests west of the Mississippi River, including the plant at Wichita.
Boeing sold their Wichita division in 2005, which became Spirit Aerosystems. In 2006, BAE Systems, a major supplier to Raytheon, Airbus and Boeing, sold their aerostructures business to Spirit and in 2019, Spirit acquired Bombardier Aviation’s aerostructures activity. Spirit continue to produce metal and composite aerostructures for Boeing, Airbus and Bombardier airliners and other aircraft manufacturers. The flight deck for almost all Boeing airliners and the fuselages for new 737 and 787 aircraft are built by Spirit.
In December 2023, a month before the accident aircraft had been delivered to Alaska Airlines, a federal securities lawsuit was filed against Spirit with allegations of deliberately concealing known issues with defects and quality control. However, it should be noted that this case is about shareholder value and not the safety of the flying public.
The door plug for the 737, manufactured by Spirit AeroSystems Malaysia, is an aluminium piece which is installed onto the fuselage. Twelve stop fittings (six on each long edge) keep the door plug from falling out, requiring the door to be lifted up. The plug is held into place vertically with four bolts, one in each fitting at the top and bottom of the plug. These bolts are secured with a nut at the bottom and a pin passed through a hole in the bolt that locks the nut into position.
After installation, the door plug can be opened without being removed in order to allow for inspection and most maintenance. After removing four bolts, the door opens outwards at the top with straps at the bottom to limit the range of motion. An upward force is needed to lift the door plug’s guide tracks off of the guide pins and open the door.
The door plug from the aircraft was recovered from the backyard of a private residence. It was mostly intact and took only minor damage. However, the four bolts that would normally be removed to open the door, two vertical momevement arrestor bolts and two upper guide track bolts, were not recovered on the scene. The forward lower hinge guide fitting and the forward lift assist spring are also still missing.
The NTSB inspected what they had.
The upper guide fittings were fractured vertically with no evidence of pre-existing cracks or damage.
There was considerable damage to the stop pins and stop pads and fittings, all consistent with the door plug forcibly shifting up and then falling out.
However, the upper guide track bolt holes, where two of the missing bolts should have been, showed no damage at all. The paint in the bolt-hole bores did not show any evidence of contact damage.
Similarly, the bolt hole bore for the forward vertical movement arrestor bolt was undamaged. The aft bolt-hole bore was slightly elongated and showed some cracking that was likely caused by the hinge fitting shaft bending. There was no other damage to the hole bore.
There was clear damage except for around the bore holes where the vertical movement arrestor bolts and upper guide track bolts should have been. These are exactly the four bolts that are used to open the plug for maintenance and installation.
Conclusion: they were missing before the door plug started to move.
Alaska Airlines took possession of the new aircraft on the 31st of October 2023 and put it into service on the 11th of November, 2023. The aircraft was in service for 56 days, during which time it had accumulated 510 total flight hours over 154 cycles, where a cycle is a single take-off and landing.
No maintenance or inspections took place which required the door plug to be opened or removed during this time.
However, there was an issue before Alaska Airlines received the aircraft.
After the door plug was installed into the fuselage, there was a minor quality notification, as the seal was not perfectly flush. The engineering team confirmed that that seal was structurally and functionally acceptable, so there was no need to rework. The fuselage, with the door plug installed, was shipped to Boeing’s facility in Renton, Washington.
At the Boeing facility, they noticed five damaged rivets on the edge frame by the door plug. On the 1st of September, Boeing staff took photographs to show the damaged rivets including this one.
I do not know why there is an eye (possibly a beholder?) drawn on the window; I suspect it’s a reminder to someone to take the protective film off.
The important point here is not the damaged rivets but the fact that in this photograph, all of the bolts of the door plug can clearly be seen and are in place.
The fuselage was sent back to Spirit Aerospace Systems for repair. The engineers needed to open the door plug to replace the rivets, so they needed to remove the two vertical movement arrestor belts and the two upper guide track bolts. Spirit Aerosystems took a photograph of the plug door open while they were doing the rivet work. The photo is taken from inside the aircraft with the plug door open outwards and held in place by the straps on the bottom.
The engineers completed the work on the 19th of September.
That evening, a Boeing employee took a photograph of the area of the repairs and sent it to other Boeing staff via text message as a part of the discussion of the interior restoration that was needed as the rivet rework was finished.
This photograph includes a clear view of the closed door plug, including three of the bolt holes. The bolts are not there. The fourth location isn’t visible in the photograph.
circles show the three locations without the retaining bolts, two vertical movement arrestor bolts and the forward upper guide track bolt.
The aircraft was then sent to AAR Corporation in Oklahoma to have wi-fi and PCS antenna installed. AAR has retrofitted some sixty 737-9 aircraft for Alaska Airlines At no point have they had to remove or open any door plugs to complete their work.
It’s important to remember that is only a preliminary report and more information may come to light. However, it looks very much like the bolts were removed at Spirit AeroSystems to open the door plug for a repair, and then the door plug was closed and the aircraft released without the bolts in place.
There’s an interesting line in the report:
“The investigation continues to determine what manufacturing documents were used to authorize the opening and closing of the left MED plug during the rivet rework.”
This points to discrepancies in the procedures that maintenance must follow for opening and closing the plug door as a part of the Boeing or SpiritAir documentation.
This obviously isn’t the first time maintenance on a modern 737 required door plugs to be opened; however, I was unable to find any previous incidents of door plugs closed incorrectly or missing bolts. We’ll have to wait for the final report to get into more detail on this point.
Alaska Airlines immediately grounded its Boeing 737-9 fleet to inspect all mid exit door plugs. The following day, the FAA issued an emergency airworthiness directive requiring all Boeing 737-9 operators in the US (Alaska Airlines and United Airlines) to inspect their aircraft before returning them to service. Boeing released several multi-operator messages over this time, including revised instructions for inspecting the 737-9 aircraft that have the optional mid exit door plugs.
At least two lawsuit complaints have been filed on behalf of the passengers.
You can read the summary and the preliminary report on the NTSB website. The NTSB has already proposed to the FAA that aircraft with Cockpit Voice Recorders should be retrofitted to store 25 hours worth of recordings.
There’s one looming question on my mind after reading the report and looking at the schematics for the door plug. How on earth did that door plug manage to stay in place for over 150 flights from when the aircraft was put in service in November 2023?
I understand why CVRs used to have short record times (essentially the limited record capacity of the tape loop), but in the modern world, with high capacity solid state memory, there is absolutely no reason the record time shouldn’t be measured in days or weeks, rather than hours.
Does anyone know if there is pressure to get this limit increased? Is there some concern related to “snooping” on pilots in non-event situations?
That was also my thought. I suspect there’s some union pushback (although it may not be significant), and possibly some from manufacturers and/or airlines (who pays if existing CVRs have to be replaced?). However, a bigger concern would be certifying a new storage mechanism as suitable for the rough conditions that CVRs would undergo in a crash; most people don’t expect a laptop to continue to work if it’s dropped off a building, but the contents of a dropped CVR need to be recoverable. This may have been a case of good-enough syndrome; how many accidents were there in which the pilots were (a) alive to turn off the CVR and (b) failed to do so, while (c) the CVR was relevant? Absent a very public case like this, there may not have been enough push to make all of the steps to replacement happen.
I wonder what the storage mechanisms are that modern flight recorders use. Do they just encapsulate a CF card or similar in a very ruggedized housing? It seems as though certifying an upgraded solution would be relatively straightforward if it’s just a matter of putting bigger flash chips in the same housing, but I’ve no clue.
Probably just cost. A quick google search turned up a data sheet for a combined CVR and DFR that has room for 25 hours of data and audio.
https://www.dsi-hums.com/wp-content/uploads/2023/02/018-106-DSI-CVFDR-250-revC.pdf
So getting the units isn’t a problem, but they’re all crazy expensive. The problem is crash resistance – I doubt standard consumer/industrial grade flash memory can meet the heat/shock requirements of surviving an impact, even in a ruggedized housing. For example, the unit above is supposed to survive for 15 minutes at 1100C / 2000F. Given it’s size, I suspect it might get pretty toasty inside the unit, and that can create problems with the actual flash chips themselves.
The incident plane was a 737 MAX 9, not a 737-900 as stated in the article.
Ugh, yes. Corrected.
“When he fell unconscious, an off-duty airline employee let go of his mask in order to stand up and help him and then also fell (un)conscious”
Damn. I knew hypoxia is fast, but not that fast! Apparently the low pressure actively pulls oxygen out of the bloodstream, so the time you can hold your breath at sea level has no relevance.
Also I thought the “PROUDLY ALL BOEING” painted on the nose in the first few seconds of the NTSB video to be very sad.
Even when I work on my motorcycle, I have a bin where I put all the removed fasteners. When I’m done, that bin had damn well better be empty, or match any new fasteners I put on.
However, for another expensive misplaced fasteners” story, Google for “NOAA N-Prime damage” where a satellite was supposed to be bolted firmly to a workstand with two dozen bolts. The workstand was rotated to the horizontal for access, and the satellite fell to the floor. One of the team members even commented on the empty bolt holes and was ignored.
https://www.nasa.gov/wp-content/uploads/2015/01/65776main_noaa_np_mishap.pdf
Thank you for an excellent write-up and pictures.
Interesting and potentially useful (I hope not!) information. I had naively assumed holding one’s breath was an option for brief periods off the oxygen mask. Guess not.
I can’t take credit for the pictures! :D
I have a question.
It appears that the paint in the bolt-hole bores did not show any evidence of contact damage – leading to the understandable conclusion that they were missing before the door plug started to move. Fair enough.
However, the photographs shows that the bolts were there before it was sent back to Spirit – “The important point here is not the damaged rivets but the fact that in this photograph, all of the bolts of the door plug can clearly be seen and are in place”.
So, if the bolts had been there previously, then why are there no marks to the paint from that earlier installation? Should there not be some signs of that? The pain in the outboard track bolt hole bore shown is pristine.
I’m not sure. However, the photo taken after the repairs were discussing the interior renovations needed so possibly they fixed up up the paintwork. Hopefully this will elaborated on in the final report.
The main reason for the door plug staying in place is friction, aided by the pressure differential.
As I understand, Spirit’s quality is so bad that they have their own mechanics at Boeing to do the warranty work such as those rivets.
I had read the preliminary report before and thought about summarizing it for a comment. Reading this blog post after having thought about it myself makes me appreciate how good Sylvia is at preparing these things for us!
My favorite quote from the preliminary report: “The separation of the MED plug from the airplane adversely affected the pressurization performance of the airplane”. Understatement at its finest.
That quote made me laugh out loud on the other post. I was a bit worried that you and others who had already read it would be bored this week!
If you do want to have a go at summarising a report; I’m looking for guest posts for next month!
A few interesting observations here.
I am no expert when it comes to the rapid development of computers. At my now rather advanced age, I feel that improvements that can just be absorbed by younger people are becoming a mystery to me.
I call the things “confusers”.
But I also wonder, like a few people who commented here: I have a digital camera (although I am going back to B&W film. No need to invest every two years or so in another, more advanced model and dark room work has a bit of magic about it). The digital camera is already two or three generations behind, but has a capacity of 21 megapixels. I can shoot a nearly unlimited number of highly detailed photos using a 32 gigabyte flashcard. The camera also has an impressive ability to record video, INCLUDING SOUND.
Sound only, in a CVR: how many hours could it record?
The technology exists. What in my mind would be required is to develop a heat and impact resistant casing for the card.
Loss of pressurization? The Air Alaska 737 was still climbing when the door plug blew out.
A nasty shock for the passengers, and thank the Guy Upstairs for that. The cabin pressure not at maximum, and they would still have been wearing their seat belts. I guess that the passengers, unless they had an already existing respiratory or heart condition would have survived for a long period of time at that altitude, even if the pilots would not have initiated an immediate descent.
I have cruised for several hours flying in an unpressurised Cessna 310 at FL 150 (“Faif tausant meters”) in the ‘seventies on a flight from Berlin Schoenefelt (then in the DDR) to Moscow, after our Russian navigator told us that non-compliance would result in us being intercepted (You now claimb to faif tausant meters or you see MIG, verry close!”).
I have survived two rapid decompressions in a Citation 500, the first at FL 370 and the second at FL 390. The door seal blew out, and there was a substantial gap between the door and the door frame. The second time was because the engineers, eager to make certain that it would be fixed, overdid it and did not leave any room for the seal to expand when inflated.
There was ample time to don the masks. The second time we were already cleared down to 9000 ft so we did not even declare an emergency.
As a bit of (useless?) info for pilots who still fly (older) Citations, or other pressurized aircraft fitted with the “horse collar” style mask: It is on a hook beside the side window; when needed to don it, grabbing it the pilot puts it over his or her head and pulls it out further.
This releases elastic bands that are supposed to pull it tight to the face. The problem is that over time, the bands stretch and lose most of their elasticity, so we had to perform an emergency descent whilst clutching the masks, pushing them to our face.
So our solution became a new procedure: After flight, when parking for a prolonged period of time, we would release the elastics and reset them before the next flight. Which we entered into the pre- and post flight normal checklists.
One thing I was thinking about today was that in 2014, after the MH370 disappearance, there was a lot of talk about ejectable digital recorders, which might give a better chance of retrieval in some conditions. Also, Inmarsat was very excited about offering free global tracking by satellite. I can’t remember the last time I heard about either of these.
I tried to look into it, and believe the ADS-C service does global tracking. The crux here is that there are always ways to turn a system like that off.
Inmarsat planned to offer a free position every 15 minutes with their basic service, which most commercial airlines have to allow pilots to “phone” their company. ADS-C seems to be included with that service now.
I believe Airbus began installing an Automatic Deployable Flight Recorder (AFDR) on the A-350 in 2019 (and presumably other models). They’re built by Leonardo DRS.
The door plug stayed in place without the bolts because it has a close tolerance fit where the contact between the door and the fuselage does not allow movement. The function of the bolts is only to prevent vertical motion of the door. The design is such that vertical motion requires force applied by a mechanic during maintenance. Otherwise the door remains stationary. During flight operations, pressurization forces the door into its fuselage stops which explains how it took over 500 hours of flying for the mechanism (despite unrestrained in its vertical path) to come loose and fail. I expect that routine physical jarring of the fuselage during takeoffs, landings, and turbulence eventually resulted in the door shifting upwards, sustaining damage and eventually breaking loose. During this period, the problem might have been visible on the exterior if the seam on the edge of the door became displaced. The pressurization warning should have been a clue. The airline would have been prudent to check every door seal following this report especially considering it was a new aircraft.
How can a mistake like this happen? If technicians partially install a component like this door plug but don’t complete the job (install bolts), it can appear to a later crew that the installation is complete and then be improperly released for service. To prevent such a mistake, pass down maintenance logs track installation progress and alert the many people involved. Visual warnings can also be employed such as red tape with messages. Most maintenance organizations might make such an installation a required inspection item meaning a technician separate from the installer has to buy off that it was done properly. This is basic aviation maintenance procedure that has been learned through years of mistakes and various human factors that have resulted in very reliable and safe performance. Until something like this happens.
These hazards are exacerbated in a manufacturing process when occurring out of sequence. Ie. They are unanticipated problems/faults requiring abnormal corrective action. Off the assembly line so to speak. It sounds like 2 organizations were involved Boeing and Spirit, further exacerbating the problem. They were probably rushed. Assembly lines move.
Did the airline have a representative present during final manufacturing/customer acceptance? To what extent did the airline inspect this aircraft before taking it and putting into passenger service. All very important questions. All potentially contributing. If I’m not mistaken, back in the day, United Airlines assigned an acceptance team to every airplane coming out of Boeing. Not because they didn’t trust Boeing. They were virtually married to Boeing. An airline has a different priority list: a need to take what is a product during manufacturing and make it a living working machine. Much bigger deal than many might imagine. Does United still do that? Others? Don’t know.
Aviation organizations are supposed to be operating under Safety Management Systems (SMS) that anticipate hazards, identify risk, and implement appropriate mitigations at every level. There is a clear question as to the effectiveness of SMS regarding this incident.
We should not point fingers or cast blame here. We should analyze, understand, learn, and fix.
My brief comments don’t come close to doing justice to these issues, but I hope they may help you understand what is at stake.
Respectfully
MIT weighs in: https://thereader.mitpress.mit.edu/what-boeings-door-plug-debacle-says-about-the-future-of-aviation-safety/
A moderately technical discussion of what it took to get to level of overall safety aviation has today, and some comments on how far Boeing may have strayed.
Excerpts:
I feel like there should be someone other than the flight crew who also has pulling the CVR breakers on their checklist for after an incident. Feels unfair to rely on the flight crew who are focussing on getting everyone home safe.
Something amusing:
http://www.amiflyingonaboeing.com
You enter your airline and flight number, and it tells you if it’s a Boeing aircraft.