Safety in Avionics
in the CABIN
David Evans (M.E. Air Safety Week)
avionics are being added to the cabin than in the cockpit these days, and
recent regulatory actions suggest a certain slowness in reacting to a
potential safety threat. The threat is posed by improperly installed
in-flight entertainment (IFE) systems. To be sure, new features are
being added to cockpits, such as the windshear detection technology. But
for a really massive effort, look to the IFE systems being
installed in the competitive war to attract travellers. The amount
of wiring in these networks can equal the linear feet of wiring in the
rest of the airplane - which is to say the risk of failures, arcing
and in-flight electrical fires is being doubled. Many of these
installations are done after the airplane is delivered from the
manufacturer They are approved by the U. S. Federal Aviation
Administration through the supplemental type-certificate (STC) process.
Right now, that process looks pretty porous.
a recent spate of airworthiness directives (ADS), the FAA declared that
IFE systems that cannot be turned off unless pilots pull circuit breakers
must be modified, disconnected or removed outright. The directives, 14 as
of this writing, with four more to come, stem from a wider investigative
net cast by the FAA after the fiasco over the high-power interactive
IFE installed in Swissair MD-11 and B747 aircraft.
Swissair IFE was among the first to feature in-flight video
gambling. When one of the16 Swissair MD-11s equipped with the system
crashed at Halifax. Canada, in 1998, and burnt wires were recovered from
the IFE system, Swissair officials immediately ordered the same systems on
remaining aircraft to be disconnected. Circuit breakers were pulled and
power cables literally were cut and capped, pursuant to complete removal
at a more deliberate pace.
FAA had approved the system's installation via the STC process, and a U.S.
company operating as a designated alteration station (DAS) performed the
actual work. According to internal Swissair documents, the FAA's
imprimatur went a long way toward assuring the Swiss carrier's top brass
that the system was safe to install.
officials are nowhere close to completing their investigation of the
crash, and arcing of IFE wiring is but one of many possible scenarios
triggering the in-flight fire that downed the airplane. But FAA
officials suspected almost immediately they may have fumbled the ball with
a 1999 interview with sister publication Air Safety Week, Ronald Wojnar,
deputy FAA director of aircraft certification, said, 'We immediately,
within hours of the accident, took all the clues we had. At that time,
there were small pieces with evidence of wiring problems, and that's what
launched the SCR.''
was referring to the special certification review (SCR) of the IFE
installed in the accident airplane. The team found glaring gaps in FAA
requirements and procedures to ensure that the IFE installation did not
compromise safety. So much for the agency's bland assurances two years
before the Swissair crash that all would be well with these new IFE
a March 1996 report to the U.S. Congress on interactive video gambling
systems, such as the one installed on the Swissair jet, the FAA told
legislators these new systems "have been certificated as safe from a
technical standpoint." The FAA's report itemized the evaluation of
these systems for "electrical power loading ... the potential for
fire hazard, potential interference with emergency procedures ... and
other factors affecting safe operation of the aircraft."
special certification review of the Swissair IFE installation found
otherwise. It documented a blowout of oversight. In operation, the system
generated so much heat that SR Technics engineers had to vary the range of
the air‑conditioning temperature controllers. This gambit was a
tip-off that this system was a voracious energy parasite and a
possible source of real grief.
the IFE was connected to a flight-essential bus, not a cabin bus,
and the only way it could be turned off was by pulling circuit breakers.
In other words, shutting off the cabin bus, one of the first steps in the
emergency checklist for troubleshooting smoke and fire of unknown origin
(the Swissair case), would not disconnect IFE power.
since the IFE was a "passenger convenience item", there was no
requirement for changes to the pilot's operating manual to inform the crew
about the system's functioning. In an elegant tautology, Wojnar explained
that the IFE system satisfied requirements because there were no
requirements. Wojnar said the arrangement "wasn't inherently unsafe,
although it wasn't understandable to the flight crew - It wasn't
clear to them in an emergency situation".
was a year and a half ago. In the time since, FAA officials expanded their
examination to include other IFE systems installed in various aircraft. As
in the Swissair case, they focused on the interface between the IFE and
other aircraft systems, and whether or not documentation adequately
informed flight crews of system configuration, so they could disconnect
the IFE in an emergency. The basic answer to these critical safety
questions: "No" on both counts.
the IFE installation on Swissair jets was not deemed "inherently
unsafe," the ADs recently issued for installations on other jets now
patently declare "an unsafe condition exists." In announcing the
barrage of ADS, the FAA declared its actions were unrelated to the
Swissair accident. Talk about denying the obvious. It was the
heat‑damaged IFE wires found in the wreckage that spurred the FAA to
look first at the MD-11 installation, and then to examine IFE
systems in other airplanes.
an example of the unsafe conditions now revealed, FAA investigators found
that the cockpit crews of certain Airbus A340 aircraft had no means to
fully remove power from the IFE "without locating and pulling circuit
breakers ... which are located in the avionics compartment."
FAA's rationale for modifying the IFE installation on certain
B737-300 and B737-700 aircraft pretty much captures the
central finding for some 22 IFE systems installed in Boeing, Douglas and
Airbus airliners: "The IFE system ... is connected to an electrical
bus that cannot be deactivated without also cutting power to airplane
systems necessary for safe flight ... Also, there is no means available
for the flight crew to remove power from the IFE system without pulling
the airplane flight manual (AFM) and cabin crew manual do not provide
clear instructions on how to remove power from the IFE ... This condition,
if not corrected, could result in ... inability to control smoke or fumes
in the airplane..." Imagine crawling down into the avionics bay, as
in the case of the Swissair MD-11, or in that A340 installation,
amidst a thickening cloud of acrid smoke (and, in a two-pilot cockpit,
leaving just one pilot to aviate, navigate and communicate).
mandated modifications include installing a master switch, or modifying
cockpit switching, to cut IFE power, and adding an explanation of such
switch functioning in the AFM.
short, these STC-approved installations were incompatible with safe electrical
system design practices and, with inadequate documentation, flight crews
were nigh unto clueless.
bulletins issued by various IFE contractors provided detailed instructions
to operators to modify, de-activate or remove the relevant IFE
systems. The ADs made these actions mandatory, but the FAA allowed 50%
more time, 18 months instead of the 12 months recommended in the service
bulletins, to complete the work.
only did the horses of hazard get out of the barn, the FAA allowed more
time to round them up and close the door. To be sure, the FAA is under-funded and understaffed for the magnitude of the oversight task it
must accomplish, but there are larger issues here.
is signing these STC documents? In many cases, employees of the companies
designing and marketing them, tagged designated airworthiness or
engineering representatives (DARs or DERs) by the FAA, are acting and
signing approval documents on behalf of the government. Yet the documents,
signed by civilians, as it were, bear the great seal of the FAA. The
arrangement seems fraught with the potential for conflict of interest.
these various IFE systems, the safety defences putatively provided by the
STC process weren't just penetrated, they were overrun wholesale.
oversight system prone to what might be called "incestuous
approval"' seems ripe for wholesale review - with cancelling the
arrangement outright a prominent option. The FAA's belated experience with
IFE systems provides a perfect case study of poor design practices and
piecemeal corrective actions from which such a wider assessment could now
Magazine (The Journal of Global Airspace) - May 2001
David Evans is the award-winning Editor of Air Safety Week firstname.lastname@example.org