By Richard N. Aarons/Business & Commercial Aviation
Canada's Transportation Safety Board (TSB) has completed
one of the most thorough aircraft accident investigations
ever undertaken with a final briefing on the downing of
Swissair Flight 111. Over the last four years, the TSB's
activities have led to the removal of one type of flammable
acoustic insulation from most transport aircraft and to
dozens of safety recommendations dealing with electrical
system certification, pilot training and aircraft component
In the end, the TSB determined the Swissair crew was
dealing with confusing cues and a hidden fire that
propagated fast enough to overwhelm their generally
appropriate decision-making. Nevertheless, it is instructive
to review the story of the flight and the crew's actions
when faced with an ambiguous smoke condition. The factual
information below comes from the TSB's final report.
The Swissair McDonnell Douglas MD-11 crashed at 2131 EDT
on Sept. 2, 1998, into the Atlantic Ocean five miles off of
Peggy's Cove, Nova Scotia, while its pilots attempted a
descent into Halifax after discovering a fire on board. All
215 passengers and 14 crewmembers were killed. Flight 111
had departed New York's JFK International Airport at 2018 on
a scheduled flight to Geneva.
About 53 minutes after takeoff, while cruising at FL 330,
the flight crew smelled an abnormal odor accompanied by a
visible haze in the cockpit that seemed to be coming from a
source above and behind them near the cockpit air
conditioning outlets. The pilots had received no reports
from the passenger cabin about smoke or odor.
The pilots discussed the situation and decided
the odor and smoke were related to the air conditioning
system -- usually a relatively benign occurrence,
but nevertheless, one that would require immediate
attention. At 2114:15, when the aircraft was
about 66 nm southwest of Halifax International
Airport, the pilots made a Pan Pan radio transmission
to Moncton ATC. They reported the cockpit smoke
and requested an immediate return to Boston,
which was about 300 nm behind them. The Moncton
controller immediately cleared SR 111 to turn
right toward Boston and to descend to FL 310.
At 2115:06, the controller asked SR 111 whether they
preferred to go to Halifax, which was considerably closer --
56 nm northeast. The crew accepted the clearance, and,
according to the CVR, they donned their oxygen masks.
At 2116:34, the controller cleared the flight to descend
to 10,000 feet msl and asked for the number of passengers
and amount of fuel on board. The pilots asked the controller
to stand by for that information.
At 2118:17, the controller instructed SR 111 to contact
Moncton on 119.2 MHz. The pilots immediately made contact
with Moncton on the new frequency and stated that they were
out of FL 254 on a heading of 050 degrees to Halifax. The
controller cleared the flight to 3,000 feet. The pilots
requested an intermediate altitude of 8,000 feet until the
cabin was ready for landing.
At 2119:28, the controller instructed the flight to turn
left to a heading of 030 for a landing on Runway 06 at
Halifax and advised that the aircraft was 30 nm from the
runway threshold. The aircraft was descending through
approximately FL 210 and the pilots indicated that they
needed more than 30 nm to get down. The controller then
issued a turn to a heading of 360 to provide more track
distance for the aircraft to lose altitude.
At 2120:48, the pilots decided to dump fuel based on the
aircraft's gross weight.
At 2121:20, the controller made a second request for the
number of persons and amount of fuel on board. SR 111 did
not relay the number of persons on board, but indicated that
the aircraft had 230 tons of fuel on board (this was
actually the current weight of the aircraft, not the amount
of fuel) and specified the need to dump some fuel prior to
At 2121:38, the controller asked the pilots whether they
would be able to turn to the south to dump fuel, or whether
they wished to stay closer to the airport. Upon receiving
confirmation from the pilots that a turn to the south was
acceptable, the controller instructed SR 111 to turn left to
a heading of 200, and asked the pilots to advise when they
were ready to dump fuel. The controller indicated that SR
111 had 10 nm to go before it would be off the coast, and
that the aircraft was still within 25 nm of the Halifax
airport. The pilots said that they were turning and that
they were descending to 10,000 feet for the fuel dumping.
At 2122:33, the controller heard, but did not understand,
a radio transmission from SR 111 that was spoken in
Swiss-German, and asked SR 111 to repeat the transmission.
The pilots indicated that the radio transmission was meant
to be an internal communication only; the transmission had
referred to the Air Conditioning Smoke Checklist.
At 2123:30, the controller instructed SR 111 to turn the
aircraft farther left to a heading of 180, and informed the
pilots that they would be off the coast in about 15 nm. The
pilots acknowledged the new heading and advised that the
aircraft was level at 10,000 feet.
At 2123:53, the controller notified SR 111 that the
aircraft would be remaining within 35 to 40 nm of the
airport in case they needed to get to the airport in a
hurry. The pilots indicated that this was fine and asked to
be notified when they could start dumping fuel. Twenty
seconds later, the pilots notified the controller that they
had to fly the aircraft manually and asked for a clearance
to fly between 11,000 and 9,000 feet. The controller
responded that they were cleared to fly at any altitude
between 5,000 and 12,000 feet.
At about 2124, the aircraft's FDR began to record a rapid
succession of aircraft systems-related failures. (Cable
bundles in the overhead were burning through.)
At 2124:42, both pilots almost simultaneously declared an
emergency on frequency 119.2 MHz; the controller
acknowledged this transmission.
At 2124:53, SR 111 indicated that they were starting to
dump fuel and that they had to land immediately. The
controller said he would get back to them in just a couple
of miles. SR 111 acknowledged this transmission.
At 2125:02, the crew again declared an emergency, which
the controller acknowledged. (Panels in the overhead may
have been dropping down at this point.)
At 2125:16, the controller cleared SR 111 to dump fuel;
there was no response from the pilots. At this time, radio
communications and secondary radar contact with the aircraft
were lost, and the flight recorders stopped functioning.
At 2125:40, the controller repeated the clearance. There
was no further communication between SR 111 and the
At approximately 2130, observers in the area of St.
Margaret's Bay, Nova Scotia, saw a large aircraft fly
overhead at low altitude and heard the sound of its engines.
At 2131, several observers heard a sound described as a loud
clap. Seismographic recorders in Halifax and in Moncton
recorded a seismic event at 2131:18. A massive search and
rescue effort was begun, only to become a search and
recovery effort within 24 hours.
Eventually, the wreckage was located on the ocean floor
at a depth of about 180 feet. Recovery operations yielded
all the victims and over 279,000 pounds of aircraft material
-- about 98 percent of the structural weight of the
Investigators determined that the aircraft struck the
water 20 degrees nose down with a right bank in excess of 60
degrees. Airspeed at impact was approximately 300 knots. All
passengers and crew died instantly from a combination of the
deceleration and impact forces exceeding 350 g's when the
aircraft struck the water. Pathologists found no signs of
exposure to smoke or heat on any recovered human remains.
In an extraordinarily complex investigation, the TSB
traced the origin of the fire to a wire bundle in the
overhead spaces on the left side of the cockpit just forward
of the cockpit bulkhead -- in other words, the cockpit
attic. At least one of the arcing wires was associated with
the first-class passenger entertainment system. (Since the
accident, this system has been removed from all commercial
aircraft.) Arcing in the wire bundle ignited the metallized
polyethylene terephthalate (MPET) covering material of the
surrounding acoustic insulating blankets. Fire then
propagated aft in the attic spaces.
The TSB looked carefully at the pilots' decision-making
and determined that the fire moved too quickly for the
crew's rational diagnosis and response. The pilots noticed
an unusual odor in the cockpit at 2110:38, and 20 minutes,
40 seconds later the aircraft struck the water.
"The pilots were at a significant disadvantage when
attempting to assess and react to the initial odor and
smoke," the Safety Board said. "They did not have detection
devices that could have provided accurate information about
the source of the odor and smoke. Nor did they have the
capability to distinguish with certainty between odor and
smoke from an air conditioning source, an electrical source
or a materials fire."
At first, the pilots sensed only an abnormal smell.
Twenty seconds later, they observed a small amount of smoke
entering the cockpit from the overhead panels near an air
conditioning vent. "Based on historical data," said the TSB,
"it is generally accepted that smoke from an air
conditioning system source does not pose an immediate threat
to the safety of the aircraft or passengers, and that the
threat can be mitigated through isolation procedures. Based
on their assessment that the risk from the smoke was
relatively low, it appears that the pilots saw no apparent
reason to accept the additional risk of attempting an
immediate emergency landing. Instead, they established
priorities that included obtaining the information needed
for the approach and preparing the aircraft for a safe
Investigators theorize the amount of smoke initially
entering the cockpit must have been low. Otherwise, it would
be expected that the pilots would have attempted to isolate
the smoke origin by closing off the conditioned air sources.
There is no indication on the aircraft's recorders that they
completed any action item in the Air Conditioning Smoke
Checklist. The initial smoke quickly disappeared. More than
two minutes later, the pilots confirmed that smoke had
reappeared, likely in the same area.
"Based on the typical awareness level shown by other
pilots during interviews, the SR 111 pilots would not likely
aware of the presence of significant amounts of
flammable material in the attic area of the aircraft," said
the TSB. "As a result, they would not have expected there to
be a significant fire threat from that area, or from any
other hidden area. There was nothing in their experience
that would have caused them to consider the smoke to be
associated with an ongoing uncontrolled fire consuming
flammable material above the ceiling. Industry norms at the
time of the SR 111 occurrence were such that other flight
crews, if faced with the same scenario, would likely have
interpreted the limited cues available in a similar way."
When the pilots started their descent toward Halifax at
2115:36, they thought they were dealing with an air
conditioning smoke anomaly and took steps to prepare the
aircraft for an expedited descent, but not an emergency
descent and landing.
The pilots were unfamiliar with the Halifax airport and
did not have the approach charts readily available, nor was
the back-course instrument landing approach to Runway 06
pre-programmed into their FMS. The pilots knew they would
have to take additional time to familiarize themselves with,
and set up for, the approach and landing. The pilots also
were aware that the meal service was under way, and that it
would take some time to secure the cabin for a safe landing.
"Given the minimal threat from what they perceived to be
air conditioning smoke, and the fact that there were no
anomalies reported from the passenger cabin, they would
likely have considered there to be a greater risk to the
passengers and cabin crew if they were to conduct an
emergency descent and landing without having prepared the
cabin and positioned the aircraft for a stabilized approach
and landing," said the TSB. "It can be concluded that the
pilots would have assessed the relative risks differently
had they known that there was a fire in the aircraft."
The pilots also knew the aircraft was too heavy for
landing without exceeding the maximum overweight landing
limits for non-emergency conditions. An overweight landing
would have posed some risk, but TSB investigators believe
that fact would not have deterred them from continuing for
an immediate landing, and dumping fuel during the landing
approach, if they had perceived a significant threat to the
aircraft. Coincident with their declaration of an emergency
condition, the flight crew indicated that they were starting
to dump fuel and there are indications that they did so.
The fact is that the fire lurked in the attic near the
cockpit/cabin bulkhead and most of the smoke and fire was
drawn aft by the cabin ventilation system. Only a small
amount of smoke moved forward into the cockpit. The overhead
spaces had no smoke or heat-rise detectors, so the pilots
really had no idea that they were dealing with an intense
fire. Ultimately, they switched off the cabin vent system as
they ran the checklist for smoke. At this point, smoke and
fire moved forward and the conditions in the cockpit
deteriorated rapidly leading to the declaration of
One of the central questions in this investigation had to
do with the crew response to the first appearance of an
unusual odor in the cockpit. Could the pilots have gotten
the aircraft on the ground safely had they begun an
immediate descent into Halifax at the first whiff of smoke?
Suppose they had not maneuvered to dump fuel; would the
outcome have been different? Here's the TSB's analysis:
Calculations show that if an emergency descent had been
started from the optimum starting point (when the crew
issued its Pan Pan) at 2114:18, the earliest possible
landing time would have been 2127 -- three minutes before
the time of impact. This landing time would only have been
possible if there had been no technical malfunctions or
adverse cockpit environmental conditions inhibiting the
ability of the pilots to navigate and configure the aircraft
to obtain its optimum performance capabilities. Any
deviation from these "ideal" conditions would result in a
later landing time because either the aircraft would require
extra maneuvering off the direct track to the airport, or
the aircraft would reach the airport with too much altitude
or airspeed to land.
At 2124:09, nearly three minutes before the earliest
possible landing time, the aircraft had started to
experience an increasingly rapid succession of
systems-related failures. The pilots declared an emergency
at 0124:42, slightly more than two minutes before the
theoretical earliest possible landing time. Several
additional systems-related failures, including the loss of
the copilot's flight instrument displays and communications
with ATC, occurred one minute later (2125:42), just prior to
the stoppage of the flight recorders.
By the time the recorders stopped, the cockpit
environment was rapidly deteriorating. The fire was invading
the cockpit from the overhead ceiling area. Just before the
recorders stopped, the pilots indicated that they needed to
land immediately; however, they apparently lost their
ability to navigate, as they did not steer the aircraft
toward the airport. At some point within the last five
minutes, the aircraft's slats became unserviceable. Based on
heat damage to wires and associated circuit breakers, it is
also possible that the auto ground spoilers, auto-brakes and
anti-skid braking system would have become inoperative
before the aircraft could have landed. Under such
conditions, it would have been impossible to stop the
aircraft on the available runway even if it could have
It is evident, says the TSB, that even if the pilots had
attempted a minimum-time emergency diversion starting at
2114:18, it would have been impossible for them to continue
maintaining control of the aircraft for the amount of time
necessary to reach the airport and complete a safe landing.
The time at which the crew would have had to begin an
emergency descent to achieve the optimum theoretical
emergency descent profile into Halifax coincided with the
actual time of the Pan Pan radio transmission. Any delay in
descending would mean that the aircraft would be above the
ideal descent profile. During the Pan Pan transmission, the
captain requested a diversion and suggested Boston. It was
not until about one minute and 25 seconds later that the
following events were completed: The controller offered
Halifax as an alternative diversion airport, the pilots
evaluated and accepted Halifax, and the pilots commenced a
non-emergency but rapid descent.
During that time, the aircraft was traveling in the
general direction of Halifax International Airport at a
ground speed of more than 8 nm per minute. From the actual
descent start point, it would not have been possible for the
pilots to position the aircraft for a landing on Runway 06
without some form of off-track maneuver to lose altitude and
slow to the appropriate speed. In a best-case scenario, the
extra maneuvering would have added two or three minutes to
the landing time. More likely, a maneuver such as a
360-degree turn would have been necessary, or they would
have had to switch to a different runway. Either choice
would have added several minutes to the earliest possible
landing time, and the effects of the fire would have negated
the possibility of completing a safe landing.
At about 2125, when the fire condition became distinctly
evident in the cockpit, the aircraft was about 25 nm from
the airport, at an altitude of about 10,000 feet, and at an
airspeed of about 320 knots. It was flying in a southerly
direction, away from the airport. In optimum circumstances,
from that point it would have taken a minimum of about six
minutes to get to the runway.
Theoretical calculations confirm that from any point
along the actual flight path after the aircraft started to
descend, it would not have been possible for the pilots to
continue maintaining control of the aircraft for the amount
of time necessary to reach the airport and complete a
Causes and Contributing Factors
The TSB presents its findings in different format from
the familiar "probable cause" notice favored by the U.S.
NTSB. Essentially, the TSB simply lists causes and
contributing factors and takes note of risks and other
findings that could be important to the aviation community.
This investigation generated dozens of formal
recommendations, some of which we will discuss in future
Cause & Circumstance columns. In the meantime, here are some
of the TSB's more significant findings of cause and
contribution. They present important issues for all
Aircraft certification standards for material
flammability were inadequate in that they allowed the use of
materials that could be ignited and sustain or propagate
Metallized polyethylene terephthalate (MPET)-type
cover material on the thermal acoustic insulation blankets
used in the aircraft was flammable. The cover material was
most likely the first material to ignite, and constituted
the largest portion of the combustible materials that
contributed to the propagation and intensity of the fire.
Once ignited, other types of thermal acoustic
insulation cover materials exhibit flame propagation
similar to MPET-covered insulation blankets and
do not meet the proposed revised flammability test criteria.
Metallized polyvinyl fluoride-type cover material was
installed in the aircraft and was involved in the inflight
Silicone elastomeric end caps, hook-and-loop
fasteners, foams, adhesives and thermal acoustic insulation
splicing tapes contributed to the propagation and intensity
of the fire.
The type of circuit breakers used in the aircraft was
similar to those in general aircraft use and was not capable
of protecting against all types of wire arcing events. The
fire most likely started from wire arcing.
There were no built-in smoke and fire detection and
suppression devices in the area where the fire started and
propagated, nor were they required by regulation. The lack
of such devices delayed the identification of the existence
of the fire, and allowed the fire to propagate unchecked
until it became uncontrollable.
There was a reliance on sight and smell to detect and
differentiate between odor and smoke from different
potential sources. This reliance resulted in the
misidentification of the initial odor and smoke as
originating from an air conditioning source.
There was no integrated inflight firefighting plan in
place for the accident aircraft, nor was such a plan
required by regulation. Therefore, the aircraft crew did not
have procedures or training directing them to aggressively
attempt to locate and eliminate the source of the smoke, and
to expedite their preparations for a possible emergency
landing. In the absence of such a firefighting plan, they
concentrated on preparing the aircraft for the diversion and
There is no requirement that a fire-induced failure be
considered when completing the system safety analysis
required for certification. The fire-related failure of
silicone elastomeric end caps installed on air conditioning
ducts resulted in the addition of a continuous supply of
conditioned air that contributed to the propagation and
intensity of the fire.
The loss of primary flight displays and lack of
outside visual references forced the pilots to be reliant on
the standby instruments for at least some portion of the
last minutes of the flight. In the deteriorating cockpit
environment, the positioning and small size of these
instruments would have made it difficult for the pilots to
transition to their use and to continue to maintain the
proper spatial orientation of the aircraft.
The items below are "Findings as to Risk," meaning they
present issues of concern reaching beyond the particular
circumstances of Swissair 111.
Although in many types of aircraft there are areas
that are solely dependent on human intervention for fire
detection and suppression, there is no requirement that the
design of the aircraft provide for ready access to these
areas. The lack of such access could delay the detection of
a fire and significantly inhibit firefighting.
In the last minutes of the flight, the electronic
navigation equipment and communications radios stopped
operating, leaving the pilots with no accurate means of
establishing their geographic position, navigating to the
airport and communicating with air traffic control.
Regulations do not require that aircraft be designed
to allow for the immediate de-powering of all but the
minimum essential electrical systems as part of an isolation
process for the purpose of eliminating potential ignition
As is the case with similar checklists in other
aircraft, the checklist for isolating smoke or odors in the
MD-11 could take 20 to 30 minutes to complete, long enough
to allow anomalies, such as overheating components, to
develop into ignition sources.
Neither the Swissair nor the manufacturer's
Smoke/Fumes of Unknown Origin Checklist emphasized the need
to immediately start preparations for a landing by including
this consideration at the beginning of the checklist.
Including this item at the end of the checklist
de-emphasizes the importance of anticipating that any
unknown smoke condition in an aircraft can worsen rapidly.
Examination of several MD-11 aircraft revealed various
wiring discrepancies that had the potential to result in
wire arcing. Other agencies have found similar discrepancies
in other aircraft types. Such discrepancies reflect a
shortfall within the aviation industry in wire installation,
maintenance and inspection procedures.
The consequence of contamination of an aircraft on its
continuing airworthiness is not fully understood by the
aviation industry. Various types of contamination may damage
wire insulation, alter the flammability properties of
materials or provide fuel to spread a fire. The aviation
industry has yet to quantify the impact of contamination on
the continuing airworthiness and safe operation of an
Inconsistencies with respect to circuit breaker reset
practices have been recognized and addressed by major
aircraft manufacturers and others in the aviation industry.
Despite these initiatives, the regulatory environment,
including regulations and advisory material, remains
unchanged, creating the possibility that such "best
practices" will erode or not be universally applied across
the aviation industry.
Approach charts for Halifax International Airport were
kept in the ship's library at the observer's station and not
within reach of the pilots. Retrieving these charts required
both time and attention from the pilots during a period when
they were faced with multiple tasks associated with
operating the aircraft and planning for the landing.
As you can see, this investigation gives us much to think
about. On a personal note, I have been studying accident
investigations for over four decades. The TSB spent four
years and well over $50 million on this one. It is one of
the most thorough investigations and reports ever
undertaken. Like the NTSB's TWA 800 investigation, the TSB's
search for the cause of the loss of Swissair 111 is a model
for future investigations and can serve as a textbook for a
new generation of accident investigators. B/CA
Reprinted from the May 2003 issue of
Business & Commercial Aviation magazine