Avionics, Etc.

Cockpit Door and Something More

After September 11, 2001, there was a mandate for reinforced cockpit doors. So commercial operators started installing doors. Just like with other projects, the first year is the year of discovering if the design is good. But then there is the multi-million dollar project and the multi-million dollar question: would there be a child disease? Sure enough, on some aircraft problems were reported with door-locking solenoids.

The locking mechanism includes a solenoid, which is supposed to push the locking pin into a hole in the doorframe. If the solenoid is powered, it uses approximately 3.5 amps to kick the locking pin into the hole. After that, the amperage is reduced to less than 0.1 amp and the locking pin stays in the hole. The door is now locked.

On some airplanes, due to mis-adjustment, the locking pin won't go into the hole but hits the edge of the hole. As long as the pin is stuck on the edge, the 3.5-amp current flows through the coil of the solenoid and the solenoid remains powered. The heat caused by the current cannot be dissipated and the solenoid gets hotter and hotter until it starts to burn. Believe me, pilots don't like a burning smell and smoke and fire in the cockpit, especially at 40,000 feet. So the manufacturer designed a fix.

There is a service bulletin to install a temperature sensor at the solenoid body. If the door sticks, after about 90 seconds the sensor senses the overheating and switches off the current. The fix costs about $400.

Once upon a time an engineer went to the financial people to ask for a budget of $50,000 to modify 100 airplanes. The financial person asked why the engineer needed so much money. He told the story about the door and the solenoid and the hole and the pin and the 90 seconds and the smoke and the fire and the modification. The financial person asked the engineer: "Why didn't they design the pin and the hole in such a way that it always fits?" And she was right. A decent carpenter is able to install the door properly and it will always fit and lock and work. The expensive engineer created a potential source of fire.

If the design was good in the first place, the temperature sensor would have been installed during door production. Many doors were manufactured and certified and nobody asked about possible solenoid overheating and fire. The engineers assumed that they were smarter than the carpenters and that they had designed the perfect locking mechanism, which does not need over-temperature protection. They were wrong. In the first year there were a lot of burned solenoids, smoke, and fires, and the manufacturers had to develop the fix. This is the lesson: think about the protection. The pilots cannot afford to fight a fire at 40,000 feet.

It is a pity that we have to conclude that neither engineers, DERs, failure analysts, nor technicians thought about protection of the circuit.

If a quality locking mechanism and sufficient protection were designed, everybody would be talking about the cockpit door as a successful project. Now the cockpit door is used as an example of bad design, smoke and fire, and poor engineering. Airlines have to spend a lot of money to fix the problem. There was obviously not enough money when manufacturers designed the reinforced doors. But now the airlines are supposed to find money to fix the problem.

The story is not over. That was the easy part. Implementation is the tricky part. The solenoid assembly is not a rotable. And some airlines have a policy that the modification cannot be accomplished by the avionics shop. They are used to sending rotables from the airplane to the avionics shop and back, but if the assembly is sent to the shop, it will be difficult to track it because it is not recognized as a rotable and it will get lost somewhere on the way.

Some airlines don't have the flexibility to tackle this problem. What usually happens is that the avionics shop refuses to accept the solenoid assembly because it is not a rotable. The hangar technicians are willing to do the job but the engineer doesn't agree because he is not convinced that the modification and the test can be done in the hangar (remember, you just need a clock and a power supply). Further, some airlines cannot sign off the vendor service bulletin if the job is performed in the hangar because of legacy computer systems that don't allow signing off a vendor service bulletin in the hangar. That can only be done in the shop.

Instead of those departments working proactively to help each other to solve that silly issue, they are making it difficult for each other. This is a bizarre situation. If the modification is technically and logistically complicated and expensive, everybody cooperates. But, if it is just a matter of installing a temperature sensor and reconnecting two wires and checking if a sensor trips after 90 seconds of overheating, it becomes rocket science. This is one of those amazing aviation stories, which are difficult, even impossible, to explain.