April 7, 2003
Volume 17 Issue 14
Use the table of contents below to jump to the stories that interest
you, or use the scroll bar to browse through the entire issue.
Canadian Investigators Decry Lack of Preparedness for In- Flight
Swissair MD-11 crash probe reveals flammable materials,
inadequate fire defenses
Already in a dire situation, with one system after another failing,
Capt. Urs Zimmermann must have been startled when the ceiling panel over
his seat in the cockpit of the Swissair MD-11 burned through. The
opening unleashed a torrent of hot gas and a dark cloud of charred
fiberglass particles released by the insulation blankets whose flammable
covering had burned away.
At that moment, with the sudden exclamations from Zimmermann and
First Officer Stefan Loew on the radio of "Mayday," the urgency of the
intended divert to Halifax became a matter of utter desperation, the
planned overnight flight from New York to Geneva now completely
Zimmermann and Loew were in a dark cockpit, filling with smoke and
hot gas, gasping futilely for breath when the line supplying emergency
oxygen to them was melted by the heat of the inferno in the space above
the cockpit. Large red X's appeared on five of their six "glass cockpit"
displays showing they were no longer functional, the master caution
alarm was sounding insistently, and the runway just 30 miles distant was
so close, yet so far away. They didn't make it. The aircraft hit the
water nose-down, in a steep bank, at a speed of some 300 knots. The
force of deceleration was equivalent to 350 Gs - killing all 229 aboard
instantly. Broken bodies and broken aluminum were "commingled," in the
delicate euphemism employed by investigators.
The remains of one passenger, a pilot, were found with a life jacket
on. Even though smoke from the fire raging overhead never clouded the
cabin, he must have known the situation was more serious than the crew's
Capt. Zimmermann was not in his seat at the moment of impact. Most
likely he had been driven out by the rain of melted plastic and the
sudden downrush of hot gas. The effect perhaps was like that of a match
held too close to a strip of celluloid motion picture film. It is a
common image - the film darks, then a hole breaks open and the burnt
edges of the film melt away, opening the breach. In short order, the
film is consumed entirely.
The accident postmortem
The Transportation Safety Board (TSB) of Canada recently
concluded its exhaustive investigation into the tragic Sept. 2, 1998,
loss of Swissair Flight 111. At a March 27 press conference, TSB
chairman Camille Thériault asserted that the report "has changed the
face of aviation safety." Investigator in charge Vic Gerden more
circumspectly characterized the fire on the Flight 111 jet as "a wake up
call to the industry."
The dry wording of the TSB's 300-page report is an indictment of
benign regulatory neglect before the accident, and a "business as usual"
attitude since. The final 20 pages of the report, which focus on the
actions taken or, more accurately, not taken, repeat the phrase, "The
board is concerned that regulatory authorities and the aviation industry
have not moved decisively."
Expressions like "The board has yet to see," or "the board remains
concerned" appear with depressing frequency. Yet the case deals with one
of the greatest hazards in airline operations - fire. The TSB report is
a massive case study of the hazard, and a detailed catalog of actions
needed but not yet taken (see compendium of complacency).
In this respect, the TSB report is to fire what the U.S. National
Transportation Safety Board (NTSB) is to explosions. In addressing
the hazard posed by flammable vapors in fuel tanks, the NTSB has said it
is not enough to engage in a hopeless pursuit of errant ignition sources
- the vapors must be eliminated, thereby removing the potential for
catastrophe. What the NTSB has declared about gases, the TSB is now
asserting about solids - if the materials used in the airplane are not
flammable, then the occurrence of an ignition source does not portend a
deadly fire. Just as TWA Flight 800 was destroyed in 1996
by a tiny electrical spark inside the center wing tank, which started
the whole debate about fuel tank safety, the TSB has found that a tiny
electrical spark in the attic area over the cockpit of Flight 111
ignited flammable metalized mylar thermal acoustic insulation blankets.
The fire spread, feeding on other flammable materials, some supposedly
fire- resistant but readily igniting nonetheless as the fire spread with
the rapacious speed of a grassfire on the African savannah.
Seduced by smoke
The first telltale sign misled Zimmermann and Loew. They thought the
odor and the wisp of smoke entering the cockpit from the center vent
overhead was indicating a problem with the air conditioning system. Loew
even stood up in his seat to take a sniff. The two pilots had no way of
knowing that the power cable for the airplane's interactive in-flight
entertainment network (IFEN) had arced, setting off a train of arcing
events and igniting a hidden fire above and just behind them. Initially,
no circuit breakers tripped. The smoke flowed down to the electronics
and equipment (E&E) bay, and also back into the attic area over the
cabin, following a corkscrew path and finally seeping into the cockpit.
When, as part of the troubleshooting checklist for smoke and fire of
unknown origin, the ventilation fans for the cabin were turned off, the
smoke reversed course. Now, instead of being sucked aft, it flowed
toward the cockpit.
About a minute before the fans were turned off, the pilots radioed
their intention to divert and land at Halifax's runway 06. At their
distance and altitude from the airport, already it was too late by some
four minutes. And even if they had been able through a supreme act of
airmanship to bring the airplane to touchdown with concrete rather than
impact with water, they would not have been able to stop before running
out of runway. The ground sensing system was burned through. Without it,
auto spoilers and antiskid brakes were inoperative. The electrical
circuitry for the leading edge slats was burned through. With slats
retracted and only 28º trailing edge flaps, the airplane would have
needed at least 9,600 ft. to come to a stop. The runway is 8,800 ft.
Four minutes had elapsed between the time the captain first noticed
smoke and said, "Look," to the decision to divert. If they had started
to descend at that first instant - well, maybe they would have made it.
But remember, the smoke was seductive, showing itself, then
disappearing, then showing itself again. What would have helped? Fire
detection and suppression in the attic space, not required but part of
the TSB's battery of corrective recommendations, would have enabled the
pilots to determine if they were facing an air conditioning or
electrical system malfunction.
As part of its Modification Plus program, with fire detection,
suppression, and closed-circuit television retrofitted by Swissair (now
Swiss) into the attic space of at least nine of the accident
MD-11's sister ships, those crews at least have a means of detection,
remote surveillance and a means to fight fire (see ASW, March 12,
2001, and July 30, 2001). The Modification Plus aircraft also
feature increased wire/bundle separation, more fire-resistant end caps
on the ducting and oxygen line, and include a state-of-the-art standby
flight display. For the attic space, the rest of the world's airline
fleet remains naked in the face of fire.
Raising the safety bar - but not high enough
The actions taken with respect to improved circuit breakers and more
fire- resistant tests of insulation blankets also fall short, according
to the TSB. The Federal Aviation Administration (FAA) is placing
great faith in arc- fault circuit breaker (AFCB) technology as a means
of preventing dangerous arcing events from frayed, chafed or damaged
wiring. However, circuit breakers work "upstream" of a wire fault,
acting after the insulation has been breached to prevent further damage.
Moreover, the TSB noted that the vaunted AFCB technology the FAA is
pursuing might not limit the energy of even a fleeting arc to an
intensity below the ignition temperature of adjacent materials. The same
AFCB technology for residential use must meet this standard.
The FAA also is advertising its new radiant panel test, developed in
the wake of the Flight 111 tragedy, as a means of subjecting thermal
acoustic insulation blankets to a more rigorous test of fire resistance
(see ASW, Aug. 16, 1999). On this front, too, the TSB found that
the new standard for materials could be more challenging:
- The test sample is oriented horizontally, not vertically. An
upright position would be a more demanding test.
- The test sample is not pre-heated. Even though the radiant panel
test is derived from an American Society for Testing and Materials
(ASTM) protocol, it does not include that procedure's pre-heat
- The radiant panel test does not indicate how the flammability
characteristics of tape, scrim, attachment fittings and so forth will
be assessed in various combinations and installations when only three
specimens of the insulation must be tested.
- The radiant panel test uses a flame. TSB investigators found that
insulation blanket material is far more likely to be ignited by the
higher heat of an electrical arc.
Reporters at the TSB's press conference suggested that if the IFEN
had not been installed improperly, or at all, Flight 111 might not have
been downed by fire. To be sure, the system was connected to a flight
essential power bus, the installers having discovered that the IFEN drew
too much current to be connected to the non-essential cabin bus. The
evidence suggests that the IFEN power circuit arced first. The whole
sordid breakdown of FAA oversight of the system's approval and
installation is embarrassing enough, a sloppy legacy which FAA officials
belatedly have conceded (see ASW, Sept. 13, 1999). But TSB
investigators counter that the IFEN's potential for electrical mayhem is
a secondary issue. If arcing cannot ignite the surrounding materials,
the arcing danger is blunted. It is the same argument the NTSB has been
propounding for inerting flammable vapors as the best means of
outflanking the hazard of ignition sources in fuel tanks.
It will take years, if not eventual consignment into retirement of
the entire current fleet, before newer aircraft with fire-resistant if
not fireproof materials are doing most of the flying. For those
new-design airplanes, such as the coming Airbus A380, capable of
carrying 550+ passengers on two decks, the TSB report serves as a
checklist of fire protection features that can be incorporated to guard
against that monster aircraft ever suffering the fate of the Swissair
Meanwhile, fires continue to occur in the air and on the ground. The
video display unit of the IFEN on an Air Canada A330 twinjet
burst into flames Jan. 17, 2002, while the aircraft was parked at
Vancouver. The system was being reset before boarding passengers.
Pulling the circuit breaker had no effect and a Halon fire extinguisher
was used. The video unit was removed and the aircraft departed 37
minutes late (see Cadors Number 2002P0033).
The NTSB last week released a detailed account of a Nov. 29, 2000,
in-flight arcing fire on an AirTran DC-9. As shown in a
comparison to the Swissair catastrophe, the AirTran jet was at one-tenth
the altitude and the pilot was able to make a hasty return to the
departure airport within minutes.
Take action today
The TSB report, although expressing its frustration with the glacial
pace of progress, takes the long view. Many of the deficiencies it cites
will take years to correct and for training to be institutionalized. Can
anything be done in the short term?
Yes. For one thing, the Flight 111 crew was faced with dense,
continuous smoke, which was obscuring their ability to see even the
standby instruments, much less out of the cockpit. Note the TSB reports
that in the simulator training the smoke was stopped, when it doesn't
always cease in a real crisis.
Physically displacing the smoke with an emergency vision assurance
system (EVAS) is one means of coping with continuous smoke, by means of
a clear inflatable 'bag' tailored to fit the cockpit. Although not
required by regulation, FAA-certified EVAS technology is finding its way
onto more transport category aircraft (see ASW, Oct. 21, 2002 and
Dec. 21, 1998).
Two additional ideas can be borrowed from a new approach to cockpit
and cabin fire safety propounded in 1999 by Capt. Ken Adams (see ASW,
Nov. 1, 1999). Now retired, at the time Adams was an MD-11 pilot
with Delta Air Lines [DAL]. Adams cited an in-flight fire aboard
a Federal Express DC-10 freighter in 1996 as the aircraft was
cruising at 33,000 feet, the same altitude as the Swissair trijet almost
to the day two years later. The crew landed the airplane in 20 minutes
and evacuated before the airplane was consumed by fire. Note the 20
minutes - pretty close to the same time between the initial appearance
of smoke and the loss of Flight 111. Early detection prompted the
captain's decision to land immediately.
In his concept, Adams suggested placing smoke detectors in each of
the ducts supplying air to the cabin and cockpit. Locate the detectors
right where the ducts exit the air conditioning packs. Better yet,
evenly space additional smoke detectors close to electrical wire and
bundle routings. Had such detectors been installed on the Swissair jet,
the pilots would have been able to more quickly determine if they had an
air conditioning system malfunction or a more threatening electrical
In addition, apertures could be placed in the cabin and cockpit at
hidden fire zones - areas with a high concentration of electrical
wiring/equipment and/or flammable material. With such ports, cabin crew
could use their hand held fire extinguishers to quickly apply agent into
these concealed areas. Duct detectors and access apertures could be
installed in a low cost effort that might well prevent a repeat of the
Swissair Flight 111 tragedy. Against the day of the strategic fire
protection improvements called for by the TSB, this minimalist approach
could be done quicker and cheaper than the effort undertaken after the
1996 crash of a ValuJet DC-9. A belly hold fire downed the jet,
killing all 110 aboard, and within three years the entire airline fleet
was retrofitted with fire detection and suppression in these previously
unprotected holds. Where there is a will, the industry finds a way.
>> The TSB's full report of the SR 111 accident may be viewed at
Cases Compared Characteristics in common -
Swissair Flight 111, Sept. 2, 1998
AirTran Flight 956, Nov. 29, 2000
|Altitude at beginning
||Cruise at 33,000 ft.
||Climbing through 3,800 feet
|Time of day
||Unusual odor, temporary wisps of
smoke out of cockpit center air vent.
||Popped circuit breakers, Master
Caution and other warning lights illuminate, smoke emanates from
left sidewall in forward cabin.
||Advise ATC of intent to divert to
Boston. Cabin bus switched off.
||Emergency power selected; generators
taken off line; cabin pressurization to manual.
|Plan of action
||Divert to Halifax, closer than
||Immediate return to Atlanta.
|Further symptoms during descent
||Smoke in cockpit. Circuit breakers
pop. Loss of most primary instruments and displays. FDR records
multiple system failures. Loss of FDR/CVR & radar transponder.
||Left attitude direction indicator (ADI)
fails intermittently; cockpit lights flicker; captain fears all
cockpit instruments will fail. Loss of CVR & radar transponder.
Smoke in forward cabin.
||20 min., 40 seconds
||7 min., 50 seconds
||Fatal. Loss of control; nose down
impact with water at 300 knots. Wires and cables recovered with
clear evidence of arcing/fire damage.
||Successful emergency landing and
evacuation via slides with minor injuries. Fire and soot damage to
|Sources: TSB, NTSB
The Bottom Line of the Swissair Flight 111 Tragedy
The TSB believes that the use of a material, regardless of its
location, type, or quantity that sustains or propagates fire when
subjected to realistic ignition scenarios, constitutes an unacceptable
risk, and that, as a minimum, material used in the manufacture of any
aeronautical product should not propagate or sustain a fire in any
realistic operating environment.
Source: TSB, SR 111 final report, p. 280
'Long Known Safety Hazards'
Lyn Romano, chair of the International Aviation Safety Association,
reacted to the TSB's final report on the Swissair Flight 111 crash:
I was in Halifax to attend the Transportation Safety Board
(TSB) of Canada's March 27 release of the Swissair Flight111
report and was impressed with the exhaustive efforts and expertise that
went into the investigation of this crash of an MD-11 trijet.
For those who have not followed this investigation closely, the TSB's
findings and recommendations might come as a surprise. The crash of
Flight 111 was due to issues I, as chairman of the International
Aviation Safety Association, and my colleagues and counterparts have
been aggressively pursuing with the Federal Aviation Administration
(FAA) and other regulatory agencies around the world. Due to the lack of
appropriate regulatory attention to safety issues that have plagued the
aviation industry for years 229 lives were lost.
As in the case of the fatal 1996 loss of 230 lives on TWA
Flight 800, electrical wiring once again is called into focus. The TSB
concluded that the fire started from arcing associated with the wiring
in the Swissair jet's in- flight entertainment network (IFEN), or "other
aircraft wiring" in proximity to the IFEN circuitry. The intense if even
momentary heat of the arcing ignited the metalized polyethylene
terephthalate (MPET) covering material on the thermal acoustic
insulation blankets. In the confined attic area above the cockpit and
area above the forward cabin galley, wiring was run closely, if not in
physical contact, with the flammable acoustic insulation blankets. The
covering on those blankets was the fuel that enabled the fire to grow.
As the fire spread, it fed on other flammable materials allowed on this
aircraft, resulting in the pilot's inability to retain control.
The dangerous characteristics of aromatic polyimide (trade name
Kapton) wiring, which constituted more than 95 percent of the wiring in
the area where the fire occurred, is known for its explosive
characteristics under arcing conditions and for its carbonized
insulation's ability to conduct electricity, thereby spreading the
effect of an arcing event. The dangers of polyimide wiring have been
known by the FAA and industry for years - as evidenced by efforts to use
other wire types with polyimide's weight saving benefits but without its
attendant hazards. When polyimide wiring is handled incorrectly or
placed in close proximity to a softer wire type, such as the IFEN's
Tefzel wiring, the stage is set for the two wire types to rub together
in a sandpaper effect. The harder insulation wears away that of its
softer neighbor, exposing conductor and opening a pathway door for
catastrophic arcing. Unfortunately, in the question of the "lead event'
(i.e. was the polyimide wiring the catalyst or was it the IFEN wiring?),
nothing could be stated categorically by the TSB. But of this there is
no doubt - the arcing was the match and the MPET insulation material was
the equivalent of dry tinder. This enabled the fire to spread
The certification of the IFEN system by Santa Barbara Aerospace (the
Designated Alteration Station, or DAS, acting with FAA approval) was
justifiably criticized by the TSB. The DAS did not employ personnel with
"sufficient aircraft-specific knowledge to appropriately assess the
integration of the IFEN power supply with aircraft power before granting
certification," according to the dry wording of the TSB judgment. More
bluntly, this was a case of negligence in action, considering the
authority the DAS was granted to oversee the IFEN installation.
I have highlighted just a couple of the long known safety hazards
that figured in the crash of Swissair Flight 111. How do we know that
the hazards were known? By the fact that some 50 airworthiness
directives (ADs) were issued by the FAA after the crash correcting
deficiencies in the MD-11 electrical system. Those deficiencies were
separate from the IFEN's installation. In light of the landslide of ADs
issued after the crash, it is apparent that this aircraft type was not
actually airworthy prior to the Swissair event. Moreover, electrical and
wiring standards for certification had not kept pace with the
exponential increase in wiring and electrical systems. In-flight
procedures and provisions for dealing with electrical fire and smoke
have not kept pace, either. 'Land as soon as possible' remains an
instinctively primitive last-ditch recourse and reflects the prevailing
lack of electrical redundancy.
I call upon the General Accounting Office (GAO), the
investigative arm of Congress, or the Department of Justice, to
conduct a further investigation now that the TSB has delivered its
findings. I'm only one of many who believe that the gross lack of
oversight by the regulators responsible for the safety of the flying
public points to their culpability in this tragedy. Flying involves
risks. Life involves risks. But risks can be mitigated and preventable
crashes can be avoided. Swissair Flight 111 was a preventable aviation
disaster. It is a case study in the breakdown of oversight.
I believe the time has come to demand an independent office be
established to provide more focused oversight of the FAA. If that's
construed as policing the regulator, then so be it. The Department of
Transportation's Inspector General has too shallow a remit - and the GAO
too broad. Considering the concerns expressed by some senior FAA
officials about their agency's lack of funding and shortage of people,
they might be grateful for the outside assistance and moral support.
There is a larger lesson. Every aviation disaster that can be
prevented is one less tombstone in the cemetery of 'accident' causation
- one less stone signifying lives needlessly cut short. That's why the
TSB's recommendations must be acted upon immediately.
Byline: Romano's husband, Ray, was a passenger on Swissair Flight
111. She established the International Aviation Safety Association to
further the cause of aviation safety.
Compendium of Complacency
Page numbers are those in the TSB's SR 111 report
What was not being done or required before the accident:
- There was no regulatory requirement to install smoke barriers in
passenger aircraft, or for such a barrier to meet a fire rating or
fire blocking standard (p. 13).
- The MD-11 was not certified to conduct back-course approaches
using the flight management system, FMS (p. 30).
- The flight data recorder (FDR) did not record individual air duct
or zone temperatures, cabin smoke, lavatory smoke, parameters related
to the in-flight entertainment system, or any system cues displayed on
the system display control panel, or SDCP (p. 31 & 73).
- The cockpit voice recorder (CVR) had a 30-min. capacity. It met
regulatory requirements based on 1960s technology (p. 75).
- Both recorders (FDR/CVR) were powered by the same source (p.
- There was no provision for a self-contained, independent
electrical power supply for standby communication and navigation, nor
was this required by regulation (p. 31).
- In 1975, the FAA issued a notice of proposed rulemaking (NPRM)
stating that for wire, the ... requirement for smoke emission would be
a value of 15 (maximum) within 20 minutes of the start of the test.
Although expected to be adopted, the NPRM was terminated without
affecting the existing rules (p. 41).
- The crew oxygen masks have a 6-ft. attachment line. Therefore,
with the mask on, the first officer would not be able to reach any of
the emergency equipment (p. 60).
- Prior to this occurrence, (air traffic) controllers did not
receive basic or continuation training on aircraft in abnormal or
emergency situations (p. 70).
- Quick access recorders (QARs), which capture far more information
than FDRs, are not required by regulation. It is technically feasible
to capture QAR information within the FDR crash protected environment
- The SR 111 cockpit was not equipped with an image recording
device, nor was one required by regulation. New technology provides
economical single-camera systems that can capture a 360º panoramic
view of the cockpit (p. 76).
- The underwater locator beacon (ULB) attachments were damaged to
the extent that they nearly became detached from the FDR and CVR.
There is no requirement that the recorders be tested and certified
with the ULBs attached (p. 78).
- Materials used in occupied areas had to be self extinguishing. No
testing was required for toxicity. Less stringent flammability
standards were applied to those materials used within the pressure
vessel but outside the occupied areas. No requirement existed for
these materials to be self-extinguishing. Therefore, many materials
were certified even though they were flammable (p. 107).
- Testing during the investigation demonstrated that the flight crew
oxygen system could fail in a high heat environment and accelerate a
fire. Regulatory authorities have not explained how this oxygen
system, using dissimilar metals (steel, aluminum) met the "fire
protection and prevention" certification requirement. The same holds
true for other materials that failed and exacerbated the SR 111 fire,
such as the silicon elastomeric end caps on the air conditioning ducts
- Two blanket materials in the accident aircraft are widely used in
the aviation industry, metalized polyethylene terephthalate (MPET) and
metalized polyvinyl fluoride (MPVF). Both were approved based on FAA
certification tests at the time. Between November 1993 and March 1999,
seven known occurrences took place in which MPET and MPVF-covered
insulation blankets had been ignited and propagated flame (p. 139).
- Under regulations in place at the time the MD-11 was certified, no
requirement existed to determine whether a failure of any material
would exacerbate a fire in progress. A premature breach of a certain
system, such as oxygen, hydraulic and conditioned air, could
exacerbate an in-flight fire (p. 144).
- Typically, the (FAA-required) systems safety analysis does not
include an assessment of the system's failure as a result of a fire in
progress (p. 145).
- Training for use of the Smoke/Fumes of Unknown Origin Checklist
was conducted in the simulator. To save simulator time, the simulated
smoke was terminated when the pilots selected the first position on
the selector. As was the industry norm, there was no simulator
training for an ongoing fire (p. 161). Simulator training
tended to reinforce a positive outcome to smoke- related events (p.
- No specific training was provided for locating and suppressing
fires in the cockpit or avionics compartment (p. 162).
- No specific training was provided on flying the aircraft using
only standby instruments (p. 162).
- There was no specific training on the location of potential
flammable material in the aircraft, especially in hidden areas (p.
- There was no specific training regarding firefighting in the
[cockpit] attic area [nor] specific training to the cabin crew about
fighting a fire in the cockpit. Government regulations did not require
it (p. 163).
- Regarding wire separation and routing, the regulation requires
that a potential threat be minimized; it does not require that a
potential threat be eliminated. The term "minimized" is not defined
- The adverse consequences of a circuit breaker (CB) reset may not
be well understood. On Aug. 21, 2000, the FAA issued a bulletin on
resetting circuit breakers in an attempt to standardize practices.
This bulletin was only applicable to air carriers in scheduled
operation with aircraft of 10 or more passenger seats or a payload of
more than 7,500 lbs., and this bulletin's expiration date was Oct. 31,
2001 (p. 170).
- There are no regulatory restrictions on the use of CBs as
switches. As certified and installed, the original IFEN system did not
incorporate an ON/OFF master switch (p. 171). (ASW note:
the CB was used for this purpose.)
The paucity of progress since the accident:
- Europe's Joint Aviation Authorities (JAA) require 2-hour
CVR for all aircraft certified after April 1, 1998. The United States
and Canada still only require a 30-min. CVR (p. 209).
- The FAA has yet to act on the recommendation for two combined FDR/CVR
units with an independent back up power supply. Canada's
implementation timetable is linked to the FAA schedule (p. 265).
- Boom microphones [as opposed to cockpit area microphones] improve
the clarity of the CVR information. Currently, there is no regulatory
requirement for the use of boom microphones in all phases of flight
- There is no regulatory requirement that modern FDRs record QAR
data (p. 210).
- Although it is technically feasible to do so, regulations do not
require the recording of cockpit images (p. 210).
- Existing regulations do not require that underwater locator beacon
attachments meet the same level of crash protection as other data
recorder components (p. 210).
- No regulatory requirement exists for transport category aircraft
to allow for a checklist procedure that de-powers all but essential
electrical equipment for the purpose of eliminating a potential
ignition source (p. 216).
- No regulatory requirement exists governing the length of time to
complete checklists for odor/smoke events. The MD-11 checklist can
take 30 minutes or more (p. 216-217).
- The proposed arc fault circuit breaker (AFCB) technology will
improve arc detection, but the performance criteria do not limit the
arc energy to a level below the ignition level of flammable materials.
Such testing criteria have been established for residential AFCBs, but
the draft requirements for aircraft AFCBs do not include such criteria
- Six power feed cables were routed together near the overhead
switch panel in the accident aircraft. The regulations are such that
minimum separation is needed only when a wire bundle contains
essential system wires and heavy current-carrying cables (p. 225).
- The FAA still does not require more than the 60º flame test to
certify wiring. A wire systems harmonization working group has been
tasked to revise performance standards and tests (p. 281, 282).
- Controllers in Canada now receive refresher training on in-flight
smoke and fire emergencies (p. 283).
- There is no indication that regulatory authorities will mandate
the wholesale removal from existing aircraft of other flammable
acoustic insulation materials that fail the radiant panel test.
Therefore, known flammable materials will exist for decades in
thousands of aircraft worldwide (p. 284).
- The board has yet to see significant industry-wide improvements
... and is concerned that regulatory authorities and the aviation
industry have not moved decisively to ensure that aircraft crews have
adequate means to mitigate the risks posed by in-flight fire, by way
of a comprehensive firefighting plan that includes procedures,
equipment and training (p. 292).
The Investigators Speak
ASW: In the accident airplane, is there anything in its
operational, or electrical or maintenance history that indicated there
might have been something in the way of a looming electrical problem?
Vic Gerden, (TSB investigator in charge): The short answer is
no. We did look at the maintenance history of the aircraft in detail,
and there wasn't anything pointing to a discrepancy or problem that
would lead to this accident. (ASW note: The overall reliability
of the MD-11 does not compare favorably with other aircraft, based on
service difficulty reports. Although the accident MD-11 was not
included, 34 sister aircraft in U.S. service showed a sixfold greater
rate of problems with in-flight entertainment systems compared to 197
B757 and B767 aircraft; see box below).
ASW: The photo shown at the press conference of the arcing in
the bundle shows evidence of a full-blown arc, not a ticking fault. Did
the circuit protector fail to protect?
Gerden: The arc that we showed [at the press conference] was
magnified 22 times. In fact, it is barely visible to the naked eye. It
was a very small arc site. It did not trip the circuit breaker. The same
phase on that power cable arced further downstream, about 50 centimeters
or 20 inches.
ASW: How many? As the fire is spreading, it's eating into more
circuits, so now some of the other breakers might be going off line.
Gerden: Yes, sooting was found on some other breakers. Those
trips were caused by thermal tripping from the fire.
Jim Foot (TSB systems group chairman for the SR 111
investigation): You know the white indicator ring on the end of a
circuit breaker? We found some of those that were sooted. So obviously
they tripped before impact. They were a variety from the overhead
circuit breaker panel.
ASW: Vic, you mentioned that the crew lost most of
their instruments. Could you be more specific? Did they lose all six of
the glass- cockpit displays, for example?
Gerden: They lost five for sure. They would have had a red 'X'
there. There are indications that they attempted to restore information
that would have appeared on DU 2 [display unit #2, the center one in
front of the captain]. That would have been partial information. So
other than that they had standby instruments. The compass was up on the
windshield, between the two front windscreens and had to be pulled down,
and it was a pretty basic compass. And the other standby instrumentation
was not ideally set up, but it was all they had. By the time the
airplane impacted the water, the 'OFF' flag was on the standby
ASW: What are you and your [TSB] colleagues looking at to give
an assured power supply to the standby instrument?
Gerden: We issued an advisory in September 2001 dealing with
the position, the size and the additional independent power supply for
the standby instru-ment, as well as additional training for the crews.
ASW: Has any of that taken root in the industry?
Gerden: Swissair certainly made changes. They put in an
integrated display of standby instruments with a backup power supply.
Other companies have installed that same integrated standby instrument
in their MD-11s.
ASW: You mentioned that it was not possible for Capt. Urs
Zimmermann and First Officer Stefan Loew to have gotten the airplane
down to a landing. Did you explore an emergency descent, not relying on
the FMS [flight management system], just raw data, no fuel dump, and
accept the fact of an overweight landing?
Gerden: The calculation we did was just that. Under ideal
conditions, the minimum descent time and landing, with everything
working, and fuel dumping would be immaterial - you could do that if you
wanted to - but in terms of the minimum time to descend and land, it
would have taken 13 minutes from the ideal 'start of descent' point.
That would take them to 10:27 p.m. By 10:24 p.m. the systems already
were starting to fall off line and the cockpit environment was
deteriorating pretty rapidly after 10:25. So the answer is unfortunately
ASW: On troubleshooting, in trying to determine whether it is
air conditioning or something more serious, what are your thoughts on
locating smoke detectors in the air conditioning ducts to at least get a
'yes' or a 'no' on that as the first order of business?
Gerden: We're not normally in the business of creating the
solutions or attempting to go beyond identifying the safety deficiency.
We did make recommendations in terms of the requirement for built-in
smoke detectors and suppression equipment. A big adjunct to that is what
the crews should have in terms of training and procedures and access
into areas so they can have an aggressive program in place to locate
what the problem is and to deal with it as early as possible, and at the
same time to prepare the airplane to land expeditiously. It depends on
where they are over the world - they may not be able to land.
ASW: The U.S. National Transportation Safety Board
issued recommendations last year associated with the problems of
detection and suppression of fire in inaccessible spaces, and the UK's
Air Accidents Investigation Branch has cited the problem. When
the TSB recommends that we need better coverage in inaccessible areas,
how far do you have in mind - all inaccessible areas?
Gerden: This is a function of the design of the aircraft and
the risks associated with where the electrical and wiring components are
vis-a-vis combustible materials, so it would probably vary from one
airplane to the next.
ASW: You alluded to deficiencies in circuit breaker design.
Could you be more specific?
Foot: The breakers used now are all thermal. They don't catch
some of the arc faults, which don't have enough current to drive the
circuit breaker to trip. The newer ones can catch a very small arcing
event within the first few cycles of it taking place. That's a huge
ASW: Are you referring to the arc fault circuit interrupter
ASW: Have you indicated when you would like to see that sort
of technology deployed in commercial aircraft?
Gerden: We haven't put a time frame on that in the
recommendation that was issued. As soon as feasible.
ASW: It was interesting to hear the TSB's call for a cockpit
video recorder. How might that have helped in the investigation?
Gerden: It could capture switch positions, displays, circuit
breaker trips, and it could capture the cockpit environment. A picture
is worth a thousand words.
ASW: What timeline were you looking for regarding installation
of cockpit video?
Gerden: The technology is available. It's a matter of getting
Foot: EUROCAE (European Organization for Civil Aviation
Equipment) has put together a standard. It will be coming out soon.
Gerden: From an accident investigation perspective, having it
in sooner rather than later is the objective.
ASW: You envision cockpit video recording not only for new
production aircraft but also a hard mandate to retrofit into the
Gerden: Our preference would be to have a retrofit.
ASW: You indicated a need for a more comprehensive testing
standard for the thermal acoustic insulation material. The FAA developed
the radiant panel test after the Flight 111 accident. You alluded to the
need to go beyond that test. What did you have in mind?
Gerden: That test primarily is designed for a thin film
material. There are other materials that are not thin film, that are
foams and thicker materials. They may not be appropriately tested by
that one single radiant heat panel test. We're suggesting additional
tests for all types of materials used for thermal acoustic insulation
ASW: Would you be looking at smokiness, toxicity, what?
Gerden: Our approach is that the material should not sustain
or propagate fire. If it doesn't sustain a fire then toxicity or smoke
are not a problem.
ASW: On the wiring, you referenced the limitation of the 60º
vertical flame test on an unpowered wire. What would you like to see in
terms of more realistic testing?
Gerden: In our August 2001 recommendations, we called for a
test regime that evaluates the wire and its failure characteristics
under realistic operating conditions (e.g., powered), so the goal is to
prevent the risk of ignition, and the corollary is to minimize damage in
ASW: What additional policies or practices with respect to
wire installation, separation and segregation come to mind as a result
of this investigation?
Gerden: The safety concern is that the criteria used need to
be more specific and clear as to what wire separation is acceptable.
ASW: Is it possible to remove all the flammable materials used
in the construction of a modern jetliner and install non-flammable
Gerden: It's possible to remove the MPET material. That order
has been put out there. But there are other ways of mitigating the risk,
by having built in detectors, by having an in-flight firefighting plan.
The problem needs to be tackled on many fronts.
MD-11 Service Difficulty Reporting
Over 3-year period, 34 MD-11s compared to 117 B757s and 80 B767s
Greater frequency of reports for MD-11
|Public address & entertainment
|Source: AlgoPlus Consulting Ltd.
Return to the Table of Contents
Thank you for visiting Air Safety Week.