Safety Board Calls for Emergency Exit Door Redesign

Doors prove deadly if opened when cabin remains pressurized

Exit doors intended to save lives during an emergency evacuation need to be designed so they do not inadvertently kill or injure door operators if the cabin remains pressurized. The doors need to feature a vent or gate so that they can be opened safely even if the cabin pressurization system is malfunctioning.

An August 2 recommendation from the National Transportation Safety Board (NTSB) cited the Nov. 20, 2000, accident in which flight attendant/purser Jose Chiu was hurled more than 40 feet out of the left main door when it suddenly blew open as he attempted to open it during an emergency evacuation of the American Airlines [AMR] twinjet at Miami. The accident involved an Airbus A300-605R with 133 passengers and crew on board. Chiu, who by one account was thrown beyond the wingtip, was killed on impact with the concrete tarmac. A similar case occurred almost a year later, on October 20, 2001, involving an A300-605R operated by TunisAir. While an air stair was being positioned for normal deplaning, engine bleed air kept the cabin pressurized. Excessive cabin air caused the door to burst open. The flight attendant attempting to open the door was ejected, sustaining serious injuries. A second flight attendant at the doorway also ejected was killed.

In the case of the American Airlines fatality, the airplane took off from Miami for a planned flight to Haiti. Climbing through 16,000 feet, the ECAM [electronic centralized aircraft monitoring] display indicated that the forward cabin outflow valve was fully open (actually, according to sources, insulation blankets had clogged the valve).

  The aircraft pressurization system may be described as akin to a leaky balloon. Bleed air from the engines pressurizes the cabin to an artificial altitude of 8,000 feet, and one or more outflow valves regulates the discharge of cabin air to maintain a constant "cabin altitude" and to prevent sudden pressure changes during climb/descent (which passengers may notice by a popping of the ears).

Just 11 minutes after departure, and with warnings sounding from lavatory smoke detectors and a warning light indicating a possible fire in the belly hold (both false, as it turned out) the captain determined to return to Miami. He ordered an emergency evacuation upon landing.

The cabin pressure actually increased after landing, and the panoply of warnings persisted. With the cabin pressurized, none of the emergency exit doors could be opened. That is, until Door 1L suddenly blew open, ejecting flight attendant Chiu. Cabin overpressure was relieved, and all other doors with handles in the open position opened and their escape slides deployed.

Given the likelihood of future failures to outflow valves, the NTSB believes this type of overpressurization event "could occur again."

Emergency door design

Exit doors are designed with seals, latching mechanisms and structural restraints to contain the pressure of the cabin's artificial altitude during flight and yet to open smoothly on the ground. That is, when the fuselage pressure has equalized to that of ambient air. The A300 exit door opens upward over fuselage stop fittings, outward and forward parallel to the fuselage. Pressurized gas assists in the smooth opening of the door. Similar stop fittings are featured on Boeing [BA] doors.

However, the safety board is concerned that A300 emergency exit doors "do not have built-in systems to relieve pressure before the door is opened."

On all Boeing aircraft, from the B717 to the B747-400, the doors feature venting to relieve cabin pressure to a safe level before the emergency door can be opened. The NTSB voiced its "concern" that airplanes like the A300 do not have such a pressure relief system integral to the door, adding:

"The Board recognizes that pressure relief systems for emergency exit doors would depressurize the airplane slower than the opening of the outflow valves ... However, even this slower rate of depressurization would provide some protection against injury or death associated with opening the door while the airplane is still pressurized. Further, if the November 20, 2000, accident airplane had pressure relief systems for its emergency exit doors, they may have depressurized the airplane at a faster rate than the flight crew's opening of the outflow valves, which were partially blocked."

Education and training

Probing into why the cockpit crew did not alert the cabin crew to the fact that the airplane was overpressurized, the Safety Board noted that neither the carrier's flight crew operating manual [FCOM] nor its training program included information about how to recognize the signs of an overpressurized airplane. The pilots told investigators they were unaware that the airplane was still pressurized after rolling to a stop.

A similar shortcoming was found in the flight attendant safety manual. This document cautions flight attendants to evacuate the airplane immediately upon a signal from the cockpit, and to assess conditions outside the respective exits before opening them. However, the NTSB observed, "The manual does not address a situation in which all of the emergency exit doors fail to open during an evacuation and does not instruct flight attendants on recognizing the signs of an over-pressurized cabin." American Airlines was not alone - the same lack of explanatory information was found in the flight attendant safety manuals at 11 other airlines.

One flight attendant aboard the accident aircraft knew the score. As the NTSB reported:

"The flight attendant at the 4R emergency exit door indicated ... in a post accident interview that when she had worked for another air carrier, she observed a pressurization test ... and learned that the emergency doors would not open when the airplane was overpressurized on the ground.

"She stated that on the accident airplane she pulled 'up on the door handle and it went about halfway up and then ... [I] put it back down.' "

A flight attendant in the rear cabin (investigators could not determine which one) came forward and advised the captain that the doors would not open. About 40 seconds after this statement, Chiu was observed trying to force the handle with both hands. The door, under an estimated 1,500 pounds of pressure, suddenly burst open. The rush of escaping air hurled Chiu to his death. Two flight service directors in the forward area also were knocked unconscious when the door exploded open.

Desired actions

In an initial battery of recommendations emanating from the Miami accident issued May 8, 2001, the NTSB called for modifications of manuals and procedures to ensure that flightcrews verify zero cabin pressure differential before ordering an emergency evacuation. The NTSB also recommended that crews need to know the airplane will not automatically depressurize when the system is operated in the manual mode.

The latest recommendations feature three overarching goals:

1. A pressure-relief system needs to be built into the emergency exit doors of all new transport-category designs "so that they can only be opened on the ground after a safe differential pressure level is attained." The NTSB views this as a needed requirement for certification.

2. Manuals and training programs need to be upgraded to alert aircrews to the problems and procedures for dealing with exit doors when the airplane is overpressurized.

3. For existing aircraft, where it is possible for the door to be opened on the ground while the airplane is still overpressurized, a specific warning of the danger, such as lights or placards, must be placed near the door warning of the hazard.

Airbus may balk at the call to redesign the doors for future aircraft, based on its interpretation of the Miami and Tunisia accidents as crew failures. An Airbus official said, "Neither accident would have occurred had the appropriate FCOM [flight crew operating manual] procedures been followed."

"That said," the Airbus official went on to say:

"All Airbus aircraft [all models] are fitted with two automatic pressurization systems and, as a backup, a completely separate manual system. In automatic mode, prior to landing, the aircraft depressurizes and then the outflow valves are fully opened automatically. Furthermore, SOP [standard operating procedure] requires a check of delta pressure prior to opening the doors. [ASW note: 'delta pressure' is the pressure differential between the cabin and outside.]

"In manual mode, the crew controls the pressurization. During descent, the FCOM Abnormal Procedures require the crew to progressively depressurize the aircraft and, prior to landing, to fully open the outflow valves. This procedure also requires shutting off both air conditioning packs just after landing and checking delta pressure prior to opening the doors."

These remarks suggest that the manufacturer sees a failure of crew procedure rather than a need to modify the door design.

With respect to the NTSB call for warnings, the Airbus official said, "Warnings about overpressurization, both signs and lights on the doors, are standard to the A320 family and A330/A340 family aircraft. A service bulletin [SB] exists for them to be fitted to A300/A310 aircraft. [SB A300-52-6050 was issued in December 1996, before the Miami accident.] The modification is basic on A300/A310 productions from end of 1991."

A warning light may not be sufficient, and may not have prevented the fatality in Miami. Sources say it only illuminates when the engines are off, the slides are disarmed, and the cabin differential pressure exceeds 2.5 millibars (about 0.036 pounds per square inch and 5 pounds per square foot). All three conditions must be satisfied.

With the doors still armed, the warning light would not have illuminated. The TunisAir airplane was not equipped with a warning light, so the point is moot in that case.

Doors under pressure can be extremely hazardous, as evidenced by cases involving other aircraft.

And, finally, the door debate is playing out against a larger tapestry of unrequited business. A recommendation dating back to 1992 urged greater attention to the ergonomics not only of door designs, but of other items of safety equipment on airliners. That recommendation was rebuffed as unnecessary by the Federal Aviation Administration (FAA), prompting the NTSB to categorize this response as unacceptable.

(ASW note: for more on the two sets of NTSB recommendations emanating from the Miami door accident, see and

Ergonomically Unacceptable

The exchange that follows between the NTSB and the FAA highlights a still-unresolved issue about the design of emergency exit door controls. The NTSB wants the arm/disarm switch separated from the door opening mechanism to prevent inadvertent door disarming during a real emergency. Such an arrangement might also minimize the potential for opening an armed door in a non-emergency situation, which will cause the escape slide to inflate.

The extracts here span 1992-1995 and the NTSB position remains unchanged: "Unacceptable response." The need for ergonomic considerations remains relevant. One major U.S. carrier has experienced a recent rash of inadvertent opening of armed doors on aircraft models where the arming switch and opening handle are located close to one another. This same carrier has not experienced the problem on its B777 aircraft, where the arming switch and the opening lever are separated.

NTSB: Amend the Federal Aviation Regulations to include ergonomic design requirements for cabin safety equipment, including emergency exits.

FAA: The FAA does not agree ... The current certification requirements ... specify that the means of opening emergency exits must be simple, obvious, and not require exceptional effort.

It was suggested that DC-10 doors have a design-induced difficulty ... that the arm/disarm lever and the door control handle are adjacent to each other, that both are actuated by an upward motion, and that flight attendants are accustomed to using both controls during routine gate arrivals.

Considering the number of times the slides are used in actual emergency evacuations compared to the number of times the doors are opened in daily routine operations, having the arm/disarm level isolated would introduce a strong potential for inadvertently failing to disarm the slide and cause far more casualties.

NTSB reply: The ... location of the arm/disarm lever immediately adjacent to the door control handle contributes to the inadvertent disarming of DC-10 doors during emergency evacuations.

If the Safety Board accepts the FAA's logic that the isolation of the arm/disarm lever from the door operating controls could lead to 'more fatalities,' it must question the FAA's certification of the DC-10 door operating system currently used by some U.S. carriers. In this system, the arm/disarm lever is remote from the push button controls that operate the door in the normal or non-emergency mode.

Additionally, the FAA's logic contradicts its approval of other widebodied airplanes, such as the B747, in which the door arming systems are not adjacent to the door control handle. The Safety Board is not convinced that ergonomic issues are adequately addressed. Some examples are described below:

* B737, emergency landing. Shortly before landing the captain called the lead flight attendant on the cabin interphone to warn the cabin crew of an emergency. To answer the interphone, the flight attendant on the forward jumpseat had to release her restraint and leave her jumpseat and go to the forward galley to answer the interphone.

* DC-10 decompression. Passengers told to place their hands and heads on seat back in front of them to brace for emergency landing. Residual heat (about 500[ordinal indicator, masculine]F) from oxygen generators located in the seat in front of them prevented passengers from taking the brace position.

* MD-80 emergency evacuation. When the flight attendant opened the tailcone access door, [it] covered the flashlight. The cabin emergency lights did not illuminate and the flight attendant would have to unlock and partially close the access door to reach the flashlight. Consequently the flashlight was not used. The Safety Board believes that flight attendants should not hold anything in their hands when they open exits and that the flashlights should be readily accessible ... before and after opening any emergency exit.

These example demonstrate that basic ergonomic considerations are not routinely applied during the certification process ...the FAA's goal should be to prevent designs that do not meet accepted ergonomic principles rather than require operators to train crewmembers to overcome design deficiencies.

Recommendation A-92-78 Closed - Unacceptable Response.

Source: NTSB

Venting - Integral to Doors

How exit doors are designed at Boeing:

"All cabin entry/exit doors on Boeing passenger airplanes are 'plug type' doors. Fixed structural elements between the door and the fuselage called 'stops' are used to prevent the door from moving outward when the cabin is pressurized on the ground or in flight. Boeing design philosophy is to have substantial inward movement of the door against internal pressure before it can be lifted or rotated to clear these stops. In addition, the door must be unlatched before it can be moved from its securely closed position.

"On Boeing doors, the operating force to unlatch the door increases dramatically with internal pressure. Vent panels, gates, movable pressure seals and/or inward translation of the structural door, may accomplish this.

"During the unlatching phase, any residual pressure that can be overcome by operating the door is safely vented. This venting will occur while the structural door still blocks the opening and before the door lifts or rotates to provide a clear exit." Source: Boeing

Dangerous Doors - Other Cases, Other Aircraft

* June 2002, A330 widebody twinjet. Airbus technician (a 10-year veteran at the company) killed during factory pressurization test of an A330. According to an internal company message:

"This type of test is conducted on each aircraft manufactured by Airbus (300 per year). It consists of gradually increasing the pressure up to 180 millibar inside the aircraft (ASW note: this equates to a pressure differential of about 2.6 pounds per square inch, or nearly 375 pounds per square foot).

"Depressurization is also very gradual, which is why this procedure lasts for almost four hours.

"It appears that the victim, while trying to leave the aircraft in the course of the pressurization test, was thrown outside the plane with the front left passenger door.

"An investigation was immediately initiated." (ASW note: the airplane reportedly was not equipped with a warning light.)

* Dec. 2000. Bombardier CL65 regional jet, operated by Canadair. Cabin attendant ejected out of main door. According to the report filed with the Aviation Safety Reporting System (ASRS):

"Shortly after takeoff a 'door latch' warning followed a 'pax door' warning [which] appeared on the EICAS [engine indicating and crew alerting system]. I was the PF [pilot flying] and the captain ran the checklists ... The QRH [quick reference handbook] called for manual control of the pressurization system. The captain called maintenance and inquired about the airplane's pressurization, due to concerns about the airplane's internal pressure ... From what I could understand, the maintenance contact reassured the captain that it was acceptable for us to land with the indicated pressure of -200 [millibars].

"As we opened the cockpit door at the gate, the flight attendant was standing by the pax door and said, 'I can't get the door open.' Before I could say anything - it was a 'red flag' to me and I was about to tell her no - a loud noise coupled with a rapid ejection of the pax door and the flight attendant [occurred]. She was not injured but [was] visibly shaken by the experience.

"She held onto the door as it opened and went out with it and landed head down on the door.

"This could have been prevented in several ways. First, if the QRH procedure had called for the emergency depressurization to be activated, at least after landing in case the manual mode did not function properly, which would be a training issue. Either way, it would eliminate future pressurization problems on the ground and prevent crew injury upon opening the pax door. Secondly, [this] disturbing incident ... could have been avoided if [the flight attendant] had received instructions to stay seated until advised it would be safe to open the pax door. Such instructions should be standard any time pressurization problems [are] encountered."

* Nov. 1998. Emergency landing of Delta Air Lines L-1011 at San Francisco. Incident involved an electrical fire behind the flight engineer's panel (in accumulated dust and lint). Crew was unable to shut down the engines or open the doors. Only after pulling the aircraft fire shutoff handles were the engines shut down. After shutdown, the aircraft depressurized and the exit doors could be opened (see ASW, July 12, 1999).

* Nov. 1997. ATR-72 twin turboprop. Ground technician injured pulling on door when aircraft was still pressurized. According to the ASRS narrative:

"We landed in Green Bay, taxied to the gate, shut the engines down and the ground crew knocks (signal, it's clear to open the door). I try to open the entry door and it won't open. I try again and again. Knocks from the ground crew keep coming. I called the cockpit and stated, 'I can't get the door open.' They reply, 'Oh, hold on.' I then remembered the two deadheading pilots and asked for their assistance ... I stood back and they finally got the door open, which slammed to the ground.

"[We then] left for Sawyer. We land in Sawyer, taxi to the hangar, engines shut down, seat belt sign goes off, so I get up to open the door. Before I could open the door, a ground person (maintenance I assume) does not knock and opened the door. The door slammed down and hit him in the head.

"The next day the pressure problem is fixed and we leave to fly to Green Bay and Chicago. When we get to Chicago, I ... told a supervisor my whole story ... he then called the flight attendant training supervisor ... her reply was, 'If a door doesn't open, you have other exits to use.' This was not an emergency, but a routine revenue flight and why would I even consider opening another exit ... we later learned that ... the captain had not read through the full MEL [minimum equipment list] procedures for inoperative pressurization. He had failed on both times to shut down the engines to open the outflow pressure relief valve. This action results in explosive decompression when the door handle is opened. Luckily, no one was seriously hurt. However, this type [of] situation could be deadly for the unsuspecting person who walks up and pulls the door handle down."

from this link (3 pages) - Courtesy of Air Safety Week