By Richard N. Aarons/Business & Commercial Aviation

Canada's Transportation Safety Board (TSB) has completed one of the most thorough aircraft accident investigations ever undertaken with a final briefing on the downing of Swissair Flight 111. Over the last four years, the TSB's activities have led to the removal of one type of flammable acoustic insulation from most transport aircraft and to dozens of safety recommendations dealing with electrical system certification, pilot training and aircraft component fire testing.

In the end, the TSB determined the Swissair crew was dealing with confusing cues and a hidden fire that propagated fast enough to overwhelm their generally appropriate decision-making. Nevertheless, it is instructive to review the story of the flight and the crew's actions when faced with an ambiguous smoke condition. The factual information below comes from the TSB's final report.

The Swissair McDonnell Douglas MD-11 crashed at 2131 EDT on Sept. 2, 1998, into the Atlantic Ocean five miles off of Peggy's Cove, Nova Scotia, while its pilots attempted a descent into Halifax after discovering a fire on board. All 215 passengers and 14 crewmembers were killed. Flight 111 had departed New York's JFK International Airport at 2018 on a scheduled flight to Geneva.

About 53 minutes after takeoff, while cruising at FL 330, the flight crew smelled an abnormal odor accompanied by a visible haze in the cockpit that seemed to be coming from a source above and behind them near the cockpit air conditioning outlets. The pilots had received no reports from the passenger cabin about smoke or odor.

The pilots discussed the situation and decided the odor and smoke were related to the air conditioning system -- usually a relatively benign occurrence, but nevertheless, one that would require immediate attention. At 2114:15, when the aircraft was

about 66 nm southwest of Halifax International Airport, the pilots made a Pan Pan radio transmission to Moncton ATC. They reported the cockpit smoke and requested an immediate return to Boston, which was about 300 nm behind them. The Moncton controller immediately cleared SR 111 to turn right toward Boston and to descend to FL 310.

At 2115:06, the controller asked SR 111 whether they preferred to go to Halifax, which was considerably closer -- 56 nm northeast. The crew accepted the clearance, and, according to the CVR, they donned their oxygen masks.

At 2116:34, the controller cleared the flight to descend to 10,000 feet msl and asked for the number of passengers and amount of fuel on board. The pilots asked the controller to stand by for that information.

At 2118:17, the controller instructed SR 111 to contact Moncton on 119.2 MHz. The pilots immediately made contact with Moncton on the new frequency and stated that they were out of FL 254 on a heading of 050 degrees to Halifax. The controller cleared the flight to 3,000 feet. The pilots requested an intermediate altitude of 8,000 feet until the cabin was ready for landing.

At 2119:28, the controller instructed the flight to turn left to a heading of 030 for a landing on Runway 06 at Halifax and advised that the aircraft was 30 nm from the runway threshold. The aircraft was descending through approximately FL 210 and the pilots indicated that they needed more than 30 nm to get down. The controller then issued a turn to a heading of 360 to provide more track distance for the aircraft to lose altitude.

At 2120:48, the pilots decided to dump fuel based on the aircraft's gross weight.

At 2121:20, the controller made a second request for the number of persons and amount of fuel on board. SR 111 did not relay the number of persons on board, but indicated that the aircraft had 230 tons of fuel on board (this was actually the current weight of the aircraft, not the amount of fuel) and specified the need to dump some fuel prior to landing.

At 2121:38, the controller asked the pilots whether they would be able to turn to the south to dump fuel, or whether they wished to stay closer to the airport. Upon receiving confirmation from the pilots that a turn to the south was acceptable, the controller instructed SR 111 to turn left to a heading of 200, and asked the pilots to advise when they were ready to dump fuel. The controller indicated that SR 111 had 10 nm to go before it would be off the coast, and that the aircraft was still within 25 nm of the Halifax airport. The pilots said that they were turning and that they were descending to 10,000 feet for the fuel dumping.

At 2122:33, the controller heard, but did not understand, a radio transmission from SR 111 that was spoken in Swiss-German, and asked SR 111 to repeat the transmission. The pilots indicated that the radio transmission was meant to be an internal communication only; the transmission had referred to the Air Conditioning Smoke Checklist.

At 2123:30, the controller instructed SR 111 to turn the aircraft farther left to a heading of 180, and informed the pilots that they would be off the coast in about 15 nm. The pilots acknowledged the new heading and advised that the aircraft was level at 10,000 feet.

At 2123:53, the controller notified SR 111 that the aircraft would be remaining within 35 to 40 nm of the airport in case they needed to get to the airport in a hurry. The pilots indicated that this was fine and asked to be notified when they could start dumping fuel. Twenty seconds later, the pilots notified the controller that they had to fly the aircraft manually and asked for a clearance to fly between 11,000 and 9,000 feet. The controller responded that they were cleared to fly at any altitude between 5,000 and 12,000 feet.

At about 2124, the aircraft's FDR began to record a rapid succession of aircraft systems-related failures. (Cable bundles in the overhead were burning through.)

At 2124:42, both pilots almost simultaneously declared an emergency on frequency 119.2 MHz; the controller acknowledged this transmission.

At 2124:53, SR 111 indicated that they were starting to dump fuel and that they had to land immediately. The controller said he would get back to them in just a couple of miles. SR 111 acknowledged this transmission.

At 2125:02, the crew again declared an emergency, which the controller acknowledged. (Panels in the overhead may have been dropping down at this point.)

At 2125:16, the controller cleared SR 111 to dump fuel; there was no response from the pilots. At this time, radio communications and secondary radar contact with the aircraft were lost, and the flight recorders stopped functioning.

At 2125:40, the controller repeated the clearance. There was no further communication between SR 111 and the controller.

At approximately 2130, observers in the area of St. Margaret's Bay, Nova Scotia, saw a large aircraft fly overhead at low altitude and heard the sound of its engines. At 2131, several observers heard a sound described as a loud clap. Seismographic recorders in Halifax and in Moncton recorded a seismic event at 2131:18. A massive search and rescue effort was begun, only to become a search and recovery effort within 24 hours.

Eventually, the wreckage was located on the ocean floor at a depth of about 180 feet. Recovery operations yielded all the victims and over 279,000 pounds of aircraft material -- about 98 percent of the structural weight of the aircraft.

Investigators determined that the aircraft struck the water 20 degrees nose down with a right bank in excess of 60 degrees. Airspeed at impact was approximately 300 knots. All passengers and crew died instantly from a combination of the deceleration and impact forces exceeding 350 g's when the aircraft struck the water. Pathologists found no signs of exposure to smoke or heat on any recovered human remains.

Investigation

In an extraordinarily complex investigation, the TSB traced the origin of the fire to a wire bundle in the overhead spaces on the left side of the cockpit just forward of the cockpit bulkhead -- in other words, the cockpit attic. At least one of the arcing wires was associated with the first-class passenger entertainment system. (Since the accident, this system has been removed from all commercial aircraft.) Arcing in the wire bundle ignited the metallized polyethylene terephthalate (MPET) covering material of the surrounding acoustic insulating blankets. Fire then propagated aft in the attic spaces.

The TSB looked carefully at the pilots' decision-making and determined that the fire moved too quickly for the crew's rational diagnosis and response. The pilots noticed an unusual odor in the cockpit at 2110:38, and 20 minutes, 40 seconds later the aircraft struck the water.

"The pilots were at a significant disadvantage when attempting to assess and react to the initial odor and smoke," the Safety Board said. "They did not have detection devices that could have provided accurate information about the source of the odor and smoke. Nor did they have the capability to distinguish with certainty between odor and smoke from an air conditioning source, an electrical source or a materials fire."

At first, the pilots sensed only an abnormal smell. Twenty seconds later, they observed a small amount of smoke entering the cockpit from the overhead panels near an air conditioning vent. "Based on historical data," said the TSB, "it is generally accepted that smoke from an air conditioning system source does not pose an immediate threat to the safety of the aircraft or passengers, and that the threat can be mitigated through isolation procedures. Based on their assessment that the risk from the smoke was relatively low, it appears that the pilots saw no apparent reason to accept the additional risk of attempting an immediate emergency landing. Instead, they established priorities that included obtaining the information needed for the approach and preparing the aircraft for a safe landing."

Investigators theorize the amount of smoke initially entering the cockpit must have been low. Otherwise, it would be expected that the pilots would have attempted to isolate the smoke origin by closing off the conditioned air sources. There is no indication on the aircraft's recorders that they completed any action item in the Air Conditioning Smoke Checklist. The initial smoke quickly disappeared. More than two minutes later, the pilots confirmed that smoke had reappeared, likely in the same area.

"Based on the typical awareness level shown by other pilots during interviews, the SR 111 pilots would not likely have been

 aware of the presence of significant amounts of flammable material in the attic area of the aircraft," said the TSB. "As a result, they would not have expected there to be a significant fire threat from that area, or from any other hidden area. There was nothing in their experience that would have caused them to consider the smoke to be associated with an ongoing uncontrolled fire consuming flammable material above the ceiling. Industry norms at the time of the SR 111 occurrence were such that other flight crews, if faced with the same scenario, would likely have interpreted the limited cues available in a similar way."

Pilot Decision-Making

When the pilots started their descent toward Halifax at 2115:36, they thought they were dealing with an air conditioning smoke anomaly and took steps to prepare the aircraft for an expedited descent, but not an emergency descent and landing.

The pilots were unfamiliar with the Halifax airport and did not have the approach charts readily available, nor was the back-course instrument landing approach to Runway 06 pre-programmed into their FMS. The pilots knew they would have to take additional time to familiarize themselves with, and set up for, the approach and landing. The pilots also were aware that the meal service was under way, and that it would take some time to secure the cabin for a safe landing.

"Given the minimal threat from what they perceived to be air conditioning smoke, and the fact that there were no anomalies reported from the passenger cabin, they would likely have considered there to be a greater risk to the passengers and cabin crew if they were to conduct an emergency descent and landing without having prepared the cabin and positioned the aircraft for a stabilized approach and landing," said the TSB. "It can be concluded that the pilots would have assessed the relative risks differently had they known that there was a fire in the aircraft."

The pilots also knew the aircraft was too heavy for landing without exceeding the maximum overweight landing limits for non-emergency conditions. An overweight landing would have posed some risk, but TSB investigators believe that fact would not have deterred them from continuing for an immediate landing, and dumping fuel during the landing approach, if they had perceived a significant threat to the aircraft. Coincident with their declaration of an emergency condition, the flight crew indicated that they were starting to dump fuel and there are indications that they did so.

The fact is that the fire lurked in the attic near the cockpit/cabin bulkhead and most of the smoke and fire was drawn aft by the cabin ventilation system. Only a small amount of smoke moved forward into the cockpit. The overhead spaces had no smoke or heat-rise detectors, so the pilots really had no idea that they were dealing with an intense fire. Ultimately, they switched off the cabin vent system as they ran the checklist for smoke. At this point, smoke and fire moved forward and the conditions in the cockpit deteriorated rapidly leading to the declaration of emergency.

What If?

One of the central questions in this investigation had to do with the crew response to the first appearance of an unusual odor in the cockpit. Could the pilots have gotten the aircraft on the ground safely had they begun an immediate descent into Halifax at the first whiff of smoke? Suppose they had not maneuvered to dump fuel; would the outcome have been different? Here's the TSB's analysis: 

Calculations show that if an emergency descent had been started from the optimum starting point (when the crew issued its Pan Pan) at 2114:18, the earliest possible landing time would have been 2127 -- three minutes before the time of impact. This landing time would only have been possible if there had been no technical malfunctions or adverse cockpit environmental conditions inhibiting the ability of the pilots to navigate and configure the aircraft to obtain its optimum performance capabilities. Any deviation from these "ideal" conditions would result in a later landing time because either the aircraft would require extra maneuvering off the direct track to the airport, or the aircraft would reach the airport with too much altitude or airspeed to land.

At 2124:09, nearly three minutes before the earliest possible landing time, the aircraft had started to experience an increasingly rapid succession of systems-related failures. The pilots declared an emergency at 0124:42, slightly more than two minutes before the theoretical earliest possible landing time. Several additional systems-related failures, including the loss of the copilot's flight instrument displays and communications with ATC, occurred one minute later (2125:42), just prior to the stoppage of the flight recorders.

By the time the recorders stopped, the cockpit environment was rapidly deteriorating. The fire was invading the cockpit from the overhead ceiling area. Just before the recorders stopped, the pilots indicated that they needed to land immediately; however, they apparently lost their ability to navigate, as they did not steer the aircraft toward the airport. At some point within the last five minutes, the aircraft's slats became unserviceable. Based on heat damage to wires and associated circuit breakers, it is also possible that the auto ground spoilers, auto-brakes and anti-skid braking system would have become inoperative before the aircraft could have landed. Under such conditions, it would have been impossible to stop the aircraft on the available runway even if it could have landed.

It is evident, says the TSB, that even if the pilots had attempted a minimum-time emergency diversion starting at 2114:18, it would have been impossible for them to continue maintaining control of the aircraft for the amount of time necessary to reach the airport and complete a safe landing.

The time at which the crew would have had to begin an emergency descent to achieve the optimum theoretical emergency descent profile into Halifax coincided with the actual time of the Pan Pan radio transmission. Any delay in descending would mean that the aircraft would be above the ideal descent profile. During the Pan Pan transmission, the captain requested a diversion and suggested Boston. It was not until about one minute and 25 seconds later that the following events were completed: The controller offered Halifax as an alternative diversion airport, the pilots evaluated and accepted Halifax, and the pilots commenced a non-emergency but rapid descent.

During that time, the aircraft was traveling in the general direction of Halifax International Airport at a ground speed of more than 8 nm per minute. From the actual descent start point, it would not have been possible for the pilots to position the aircraft for a landing on Runway 06 without some form of off-track maneuver to lose altitude and slow to the appropriate speed. In a best-case scenario, the extra maneuvering would have added two or three minutes to the landing time. More likely, a maneuver such as a 360-degree turn would have been necessary, or they would have had to switch to a different runway. Either choice would have added several minutes to the earliest possible landing time, and the effects of the fire would have negated the possibility of completing a safe landing.

At about 2125, when the fire condition became distinctly evident in the cockpit, the aircraft was about 25 nm from the airport, at an altitude of about 10,000 feet, and at an airspeed of about 320 knots. It was flying in a southerly direction, away from the airport. In optimum circumstances, from that point it would have taken a minimum of about six minutes to get to the runway.

Theoretical calculations confirm that from any point along the actual flight path after the aircraft started to descend, it would not have been possible for the pilots to continue maintaining control of the aircraft for the amount of time necessary to reach the airport and complete a landing.

Causes and Contributing Factors

The TSB presents its findings in different format from the familiar "probable cause" notice favored by the U.S. NTSB. Essentially, the TSB simply lists causes and contributing factors and takes note of risks and other findings that could be important to the aviation community. This investigation generated dozens of formal recommendations, some of which we will discuss in future Cause & Circumstance columns. In the meantime, here are some of the TSB's more significant findings of cause and contribution. They present important issues for all operators.

Aircraft certification standards for material flammability were inadequate in that they allowed the use of materials that could be ignited and sustain or propagate fire.

Metallized polyethylene terephthalate (MPET)-type cover material on the thermal acoustic insulation blankets used in the aircraft was flammable. The cover material was most likely the first material to ignite, and constituted the largest portion of the combustible materials that contributed to the propagation and intensity of the fire.

Once ignited, other types of thermal acoustic insulation cover materials exhibit flame propagation characteristics

 similar to MPET-covered insulation blankets and do not meet the proposed revised flammability test criteria. Metallized polyvinyl fluoride-type cover material was installed in the aircraft and was involved in the inflight fire.

Silicone elastomeric end caps, hook-and-loop fasteners, foams, adhesives and thermal acoustic insulation splicing tapes contributed to the propagation and intensity of the fire.

The type of circuit breakers used in the aircraft was similar to those in general aircraft use and was not capable of protecting against all types of wire arcing events. The fire most likely started from wire arcing.

There were no built-in smoke and fire detection and suppression devices in the area where the fire started and propagated, nor were they required by regulation. The lack of such devices delayed the identification of the existence of the fire, and allowed the fire to propagate unchecked until it became uncontrollable.

There was a reliance on sight and smell to detect and differentiate between odor and smoke from different potential sources. This reliance resulted in the misidentification of the initial odor and smoke as originating from an air conditioning source.

There was no integrated inflight firefighting plan in place for the accident aircraft, nor was such a plan required by regulation. Therefore, the aircraft crew did not have procedures or training directing them to aggressively attempt to locate and eliminate the source of the smoke, and to expedite their preparations for a possible emergency landing. In the absence of such a firefighting plan, they concentrated on preparing the aircraft for the diversion and landing.

There is no requirement that a fire-induced failure be considered when completing the system safety analysis required for certification. The fire-related failure of silicone elastomeric end caps installed on air conditioning ducts resulted in the addition of a continuous supply of conditioned air that contributed to the propagation and intensity of the fire.

The loss of primary flight displays and lack of outside visual references forced the pilots to be reliant on the standby instruments for at least some portion of the last minutes of the flight. In the deteriorating cockpit environment, the positioning and small size of these instruments would have made it difficult for the pilots to transition to their use and to continue to maintain the proper spatial orientation of the aircraft.

The items below are "Findings as to Risk," meaning they present issues of concern reaching beyond the particular circumstances of Swissair 111.

Although in many types of aircraft there are areas that are solely dependent on human intervention for fire detection and suppression, there is no requirement that the design of the aircraft provide for ready access to these areas. The lack of such access could delay the detection of a fire and significantly inhibit firefighting.

In the last minutes of the flight, the electronic navigation equipment and communications radios stopped operating, leaving the pilots with no accurate means of establishing their geographic position, navigating to the airport and communicating with air traffic control.

Regulations do not require that aircraft be designed to allow for the immediate de-powering of all but the minimum essential electrical systems as part of an isolation process for the purpose of eliminating potential ignition sources.

As is the case with similar checklists in other aircraft, the checklist for isolating smoke or odors in the MD-11 could take 20 to 30 minutes to complete, long enough to allow anomalies, such as overheating components, to develop into ignition sources.

Neither the Swissair nor the manufacturer's Smoke/Fumes of Unknown Origin Checklist emphasized the need to immediately start preparations for a landing by including this consideration at the beginning of the checklist. Including this item at the end of the checklist de-emphasizes the importance of anticipating that any unknown smoke condition in an aircraft can worsen rapidly.

Examination of several MD-11 aircraft revealed various wiring discrepancies that had the potential to result in wire arcing. Other agencies have found similar discrepancies in other aircraft types. Such discrepancies reflect a shortfall within the aviation industry in wire installation, maintenance and inspection procedures.

The consequence of contamination of an aircraft on its continuing airworthiness is not fully understood by the aviation industry. Various types of contamination may damage wire insulation, alter the flammability properties of materials or provide fuel to spread a fire. The aviation industry has yet to quantify the impact of contamination on the continuing airworthiness and safe operation of an aircraft.

Inconsistencies with respect to circuit breaker reset practices have been recognized and addressed by major aircraft manufacturers and others in the aviation industry. Despite these initiatives, the regulatory environment, including regulations and advisory material, remains unchanged, creating the possibility that such "best practices" will erode or not be universally applied across the aviation industry.

Approach charts for Halifax International Airport were kept in the ship's library at the observer's station and not within reach of the pilots. Retrieving these charts required both time and attention from the pilots during a period when they were faced with multiple tasks associated with operating the aircraft and planning for the landing.

As you can see, this investigation gives us much to think about. On a personal note, I have been studying accident investigations for over four decades. The TSB spent four years and well over $50 million on this one. It is one of the most thorough investigations and reports ever undertaken. Like the NTSB's TWA 800 investigation, the TSB's search for the cause of the loss of Swissair 111 is a model for future investigations and can serve as a textbook for a new generation of accident investigators. B/CA

from this link

Reprinted from the May 2003 issue of Business & Commercial Aviation magazine