Air transportation safety investigation report A98H0003

On 2 September 1998, Swissair Flight 111 departed New York, United States of America, at 2018 eastern daylight savings time on a scheduled flight to Geneva, Switzerland, with 215 passengers and 14 crew members on board. About 53 minutes after departure, while cruising at flight level 330, the flight crew smelled an abnormal odour in the cockpit. Their attention was then drawn to an unspecified area behind and above them and they began to investigate the source. Whatever they saw initially was shortly thereafter no longer perceived to be visible. They agreed that the origin of the anomaly was the air conditioning system. When they assessed that what they had seen or were now seeing was definitely smoke, they decided to divert. They initially began a turn toward Boston; however, when air traffic services mentioned Halifax, Nova Scotia, as an alternative airport, they changed the destination to the Halifax International Airport. While the flight crew was preparing for the landing in Halifax, they were unaware that a fire was spreading above the ceiling in the front area of the aircraft. About 13 minutes after the abnormal odour was detected, the aircraft's flight data recorder began to record a rapid succession of aircraft systems-related failures. The flight crew declared an emergency and indicated a need to land immediately. About one minute later, radio communications and secondary radar contact with the aircraft were lost, and the flight recorders stopped functioning. About five and one-half minutes later, the aircraft crashed into the ocean about five nautical miles southwest of Peggy's Cove, Nova Scotia, Canada. The aircraft was destroyed and there were no survivors.

The investigation of the Swissair Flight 111 (SR 111) occurrence was complex and involved detailed examination of many operational and technical issues. The information in Part 1 of the report is organized into the subject areas specified by the International Civil Aviation Organization investigation report format. While the investigation uncovered many facts with respect to the flight, the aircraft, maintenance, personnel, and so on, only factual information that is pertinent to understanding the SR 111 occurrence is provided in this part along with some preliminary evaluation (first-stage analysis) that serves as a basis for the Analysis, Conclusions, and Safety Action parts of the report.

1.1 History of the flight

This section summarizes, in chronological order according to Coordinated Universal Time (UTC),^{Footnote 1} the main events that occurred during the flight and that are directly related to the SR 111 occurrence ending with the aircraft's impact with the water near Peggy's Cove, Nova Scotia, Canada. Refer to Appendix A–Flight Profile: Selected Events for a graphical representation of the flight path of the aircraft.

At 0018 UTC (2018 eastern daylight savings time) on 2 September 1998, the McDonnell Douglas^{Footnote 2} (MD) MD-11, operating as SR 111, departed John F. Kennedy (JFK) International Airport in Jamaica, New York, United States of America (USA), on a flight to Geneva, Switzerland. Two pilots, 12 flight attendants, and 215 passengers were on board. The first officer was the pilot flying. At 0058, SR 111 contacted Moncton Air Traffic Services (ATS) Area Control Centre (ACC) and reported that they were at flight level (FL) 330.^{Footnote 3}

At 0110:38, the pilots detected an unusual odour in the cockpit and began to investigate. They determined that some smoke was present in the cockpit, but not in the passenger cabin. They assessed that the odour and smoke were related to the air conditioning system. At 0114:15, SR 111 made a Pan Pan^{Footnote 4} radio transmission to Moncton ACC. The aircraft was about 66 nautical miles (nm) southwest of Halifax International Airport, Nova Scotia. The pilots reported that there was smoke in the cockpit and requested an immediate return to a convenient place. The pilots named Boston, Massachusetts, which was about 300 nm behind them. The Moncton ACC controller immediately cleared SR 111 to turn right toward Boston and to descend to FL310. At 0115:06, the controller asked SR 111 whether they preferred to go to Halifax, Nova Scotia. The pilots expressed a preference for Halifax, which was considerably closer. They immediately received an ATS clearance to fly directly to Halifax, which was by then about 56 nm to the northeast. At this time, the pilots donned their oxygen masks.

At 0116:34, the controller cleared SR 111 to descend to 10 000 feet above sea level,^{Footnote 5} and asked for the number of passengers and amount of fuel on board. The pilots asked the controller to stand by for that information. At 0118:17, the controller instructed SR 111 to contact Moncton ACC on radio frequency (RF) 119.2 megahertz (MHz). SR 111 immediately made contact with Moncton ACC on 119.2 MHz and stated that the aircraft was descending out of FL254 on a heading of 050 degrees^{Footnote 6} on course to Halifax. The controller cleared SR 111 to 3 000 feet. The pilots requested an intermediate altitude of 8 000 feet until the cabin was ready for landing.

At 0119:28, the controller instructed SR 111 to turn left to a heading of 030 for a landing on Runway 06 at the Halifax International Airport, and advised that the aircraft was 30 nm from the runway threshold. The aircraft was descending through approximately FL210 and the pilots indicated that they needed more than 30 nm. The controller instructed SR 111 to turn to a heading of 360 to provide more track distance for the aircraft to lose altitude. At 0120:48, the flight crew discussed internally the dumping of fuel based on the aircraft's gross weight, and on their perception of the cues regarding the aircraft condition, and agreed to dump fuel. At 0121:20, the controller made a second request for the number of persons and amount of fuel on board. SR 111 did not relay the number of persons on board, but indicated that the aircraft had 230 tonnes (t) of fuel on board (this was actually the current weight of the aircraft, not the amount of fuel) and specified the need to dump some fuel prior to landing.

At 0121:38, the controller asked the pilots whether they would be able to turn to the south to dump fuel, or whether they wished to stay closer to the airport. Upon receiving confirmation from the pilots that a turn to the south was acceptable, the controller instructed SR 111 to turn left to a heading of 200, and asked the pilots to advise when they were ready to dump fuel. The controller indicated that SR 111 had 10 nm to go before it would be off the coast, and that the aircraft was still within 25 nm of the Halifax airport. The pilots indicated that they were turning and that they were descending to 10 000 feet for the fuel dumping.

At 0122:33, the controller heard, but did not understand, a radio transmission from SR 111 that was spoken in Swiss-German, and asked SR 111 to repeat the transmission. The pilots indicated that the radio transmission was meant to be an internal communication only; the transmission had referred to the Air Conditioning Smoke checklist (see Appendix B–Swissair Air Conditioning Smoke Checklist).

At 0123:30, the controller instructed SR 111 to turn the aircraft farther left to a heading of 180, and informed the pilots that they would be off the coast in about 15 nm.^{Footnote 7} The pilots acknowledged the new heading and advised that the aircraft was level at 10 000 feet.

At 0123:53, the controller notified SR 111 that the aircraft would be remaining within about 35 to 40 nm of the airport in case they needed to get to the airport in a hurry. The pilots indicated that this was fine and asked to be notified when they could start dumping fuel. Twenty seconds later, the pilots notified the controller that they had to fly the aircraft manually and asked for a clearance to fly between 11 000 and 9 000 feet. The controller notified SR 111 that they were cleared to fly at any altitude between 5 000 and 12 000 feet.

At 0124:42, both pilots almost simultaneously declared an emergency on frequency 119.2 MHz; the controller acknowledged this transmission. At 0124:53, SR 111 indicated that they were starting to dump fuel and that they had to land immediately. The controller indicated that he would get back to them in just a couple of miles. SR 111 acknowledged this transmission.

At 0125:02, SR 111 again declared an emergency, which the controller acknowledged. At 0125:16, the controller cleared SR 111 to dump fuel; there was no response from the pilots. At 0125:40, the controller repeated the clearance. There was no further communication between SR 111 and the controller.

At approximately 0130, observers in the area of St. Margaret's Bay, Nova Scotia, saw a large aircraft fly overhead at low altitude and heard the sound of its engines. At about 0131, several observers heard a sound described as a loud clap. Seismographic recorders in Halifax, Nova Scotia, and in Moncton, New Brunswick, recorded a seismic event at 0131:18, which coincides with the time the aircraft struck the water. The aircraft was destroyed by impact forces. There were no survivors.

The accident occurred during the hours of darkness. The centre of the debris field, located on the ocean floor at a depth of about 55 metres (m) (180 feet), was at the approximate coordinates of latitude 44°24′33″ North and longitude 063° 58′25″ West.

Table 1 conveys the general time frame of the events between the first detection of an unusual odour in the cockpit and the time of impact with the water.

Table 1. Elapsed time for key events

UTC time	Elapsed time (minutes)	Event
0110:38	00:00	Unusual smell detected in the cockpit
0113:14	02:36	Smoke assessed as visible at some location in the cockpit; no smell reported in cabin
0114:15	03:37	SR 111 radio call: "Pan Pan Pan"; diversion requested naming Boston (It is unknown whether visible smoke was still present in the cockpit)
0115:36	04:58	Decision made to divert to Halifax, Nova Scotia
0120:54	10:16	Decision made to dump fuel
0123:45	13:07	CABIN BUS switch selected to OFF
0124:09	13:31	Autopilot 2 disengages, and the flight data recorder (FDR) begins to record aircraft system failures
0124:42	14:04	Emergency declared
0125:02	14:24	ATS receives last communication from SR 111
0125:41	15:03	Recorders stop recording
0131:18	20:40	Impact with water

For a more detailed description of the timeline, sequence of events, and flight profile, refer to sections 1.18.8.3 and 1.18.8.4, and to Appendix A–Flight Profile: Selected Events and Appendix D–Timeline.

1.2 Injuries to persons

Table 2. Injuries to persons

	Crew	Passengers	Others	Total
Fatal	14	215	-	229
Serious	-	-	-	-
Minor/None	-	-	-	-
Total	14	215	-	229

Post-accident medical and pathological information that describes the nature of the injuries is presented in Section 1.13, Medical Information.

1.3 Damage to aircraft

The aircraft was destroyed by the forces of impact with the water. Most aircraft debris sank to the ocean floor. Initially, some aircraft debris was found floating in the area where the aircraft struck the water, while other debris had drifted slightly west of the crash location. Over the next several weeks, debris from the aircraft was also found floating in shoreline areas and washed up on various beaches.

1.4 Other damage

Jet fuel was present on the surface of the water near the impact site for a few hours before evaporating. There was no apparent damage to the environment from the aircraft debris. The area surrounding the impact site was closed to marine traffic, including local fishery and tour boat operations, during salvage operations that lasted for approximately 13 months.

1.5 Personnel information

1.5.1 General

The SR 111 flight crew consisted of a captain and a first officer. The cabin crew consisted of a maître de cabine (M/C) and 11 flight attendants.

A flight operations officer provided standard flight preparation support to the flight crew before their departure from JFK airport.

Two air traffic controllers at Moncton ACC had radio contact with the aircraft: a high-level controller and a terminal controller.

See the supporting technical information on this topic.

1.5.2 Flight crew

Table 3. Flight crew information

Crew	Captain	First officer
Age	49	36
Pilot licence	Swiss Airline Transport Pilot Licence	Swiss Airline Transport Pilot Licence
Medical expiration date	1 November 1998	1 July 1999
Total flying hours	10 800	4 800
Hours on type	900	230
Hours last 90 days	180	125
Hours on type last 90 days	180	125
Hours on duty prior to occurrence	3	3
Hours off duty prior to work period	27	27

1.5.2.1 Captain

The pilot-in-command (captain) of SR 111 was described as being in good health, fit, and not taking any prescribed medication. He was described as someone who created a friendly and professional atmosphere in the cockpit and was known to work with exactness and precision. It was reported that there was no tension in the cockpit when flying with this captain.

The captain began flying for recreation in 1966 at the age of 18. In 1967, he joined the Swiss Air Force and became a fighter pilot. He began his career with Swissair in July 1971 as a first officer on the McDonnell Douglas DC-9 and later transitioned as a first officer to the McDonnell Douglas DC-8.

He was upgraded to captain status in April 1983 on the DC-9 and flew the McDonnell Douglas MD-80 as pilot-in-command from 1986 to 1994. In August 1994, he completed transition training to fly the Airbus A320, and became an A320 captain and instructor pilot. In June 1997, he completed transition training on the MD-11. He was qualified and certified in accordance with Swiss regulations. He held a valid Swiss airline transport pilot licence (ATPL). His instrument flight rules (IFR) qualifications for Category I and Category III approaches were valid until 21 October 1998. His flying time with Swissair totalled 9 294 hours. His last flying proficiency check was conducted on 23 February 1998.

The captain had never been exposed to a regulatory or administrative inquiry. There is no record to indicate that he had experienced an actual in-flight emergency at any time during his flying career.

As well as being a line pilot, the captain was an instructor pilot on the MD-11. He instructed in the full flight simulator on all exercises, including the pilot qualification training lesson where the Smoke/Fumes of Unknown Origin checklist is practised (see Appendix C–Swissair Smoke/Fumes of Unknown Origin Checklist). The captain was known to give detailed briefings to his students before, during, and after their simulator sessions. To increase his aircraft knowledge, the captain would question technical specialists in the maintenance department about the aircraft and its systems. During "smoke in the cockpit" training sessions, the captain required the students to explain all the steps and consequences of using the "electrical and air smoke isolation" (SMOKE ELEC/AIR) selector^{Footnote 8} prior to conducting the exercise. During these sessions, it was the captain's practice to ensure that the pilot reading the checklist would inform the pilot flying what services he or she was about to lose prior to turning the selector.

During wreckage recovery, a prescription for eyeglasses for the captain was found among the recovered personal effects. The prescription correction was for distance vision. No glasses identified as belonging to the captain were recovered. The available information indicates that the captain did not normally wear eyeglasses except sometimes for distance vision correction. The captain met the visual standard without glasses on his last aviation medical examination. The presence or absence of the captain's glasses would not have affected his ability to deal with the situations that he encountered in this occurrence.

Based on a review of the captain's medical records, there was no indication of any pre-existing medical condition or physiological factors that would have adversely affected his performance during the flight. His last medical examination took place on 29 April 1998; no medical restrictions applied to his pilot licence.

1.5.2.2 First officer

The first officer was described as being in good health and as not taking any prescription medication. He was considered to be experienced, well qualified, focused, and open-minded in performing the duties of a first officer. His cockpit discipline was described as ideal. He was described as a partner in the cockpit, with a quiet and calm demeanour; he was assertive when appropriate.

The first officer started flying in 1979, became a Swiss Air Force pilot in 1982 and completed his full-time military service in 1990. He joined Swissair in 1991 as a first officer on the MD-80 while continuing to fly in the air force part-time as a fighter pilot. In December 1995, he transitioned to the Airbus A320 as a first officer. In May 1998, he successfully completed his training as a first officer on the MD-11. He held a valid Swiss ATPL, which was issued in August 1996.

The first officer had never been exposed to a regulatory or administrative inquiry. There is no record to indicate that he had experienced an actual in-flight emergency at any time during his flying career. He was qualified and had been certified in accordance with Swiss regulations. His last proficiency check was on 16 April 1998.

The first officer had been an instructor on the MD-80 and A320, and at the time of the occurrence, was an instructor on the MD-11 as a simulator and transition instructor. He had accumulated 230 hours of flying time on the MD-11 and was described as having good knowledge of the aircraft systems. His flying time with Swissair totalled 2 739 hours.

Based on a review of the first officer's medical records, there was no indication of any pre-existing medical condition or physiological factors that would have adversely affected his performance during the flight. His last medical examination took place on 15 June 1998; no medical restrictions applied to his licence.

1.5.3 Cabin crew

The M/C and the other 11 flight attendants were fully qualified and trained in accordance with the existing Joint Aviation Authorities (JAA) regulatory requirements.

1.5.4 Seventy-two-hour history

A review of the flight and duty times for the flight and cabin crew revealed that they were all in accordance with the limitations prescribed by Swissair policies and JAA regulations.

The captain was off duty from Saturday, 29 August, up to and including Monday, 31 August, and was reported to have been well rested prior to departing for the outbound flight from Zurich to Geneva to New York on Tuesday, 1 September. Normal crew rest time was allocated to the crew while in New York.

The first officer was off duty from 30 to 31 August, and was reported to have been well rested prior to reporting for duty on Tuesday, 1 September.

On 1 September the two members of the flight crew, and 7 of the 12 cabin crew deadheaded^{Footnote 9} from Zurich to Geneva on Swissair Flight 920 (SR 920). The aircraft departed the gate in Zurich at 0643, arriving at the gate in Geneva at 0723. The remaining five flight attendants joined the rest of the aircraft crew in Geneva. The flight and cabin crews assumed flying duties on Swissair Flight 110 (SR 110), Geneva to New York. SR 110 departed the gate in Geneva at 1018, arriving in New York at 1835 on 1 September. The aircraft used for SR 110 was not the accident aircraft.

In accordance with Swissair procedures, on 2 September 1998, the day of the homebound flight to Geneva, the pilots received at their hotel a pre-flight information package from the Swissair Flight Operations Centre (FOC) at JFK airport. Included in this package was flight routing, weather, and aircraft weight information (i.e., weight based on preliminary information).

The aircraft crew checked out of their hotel in New York at 1750 local time (2150 UTC) on 2 September 1998 and arrived at the airport one hour before the scheduled departure time for SR 111 of 1950 local time (2350 UTC). On arrival at the airport, all aircraft crew members passed through terminal security and checked their bags at the Swissair check-in area. The cabin crew proceeded directly to the aircraft. The pilots reported to the FOC where they completed their flight planning and then proceeded to the aircraft. The flight departed the gate in New York at 1953 local time (2353 UTC).

The aircraft crew's circadian^{Footnote 10} time was likely close to Swiss time (UTC plus two hours) as they would not have had enough time in New York to significantly adjust their circadian rhythm to local (New York) time. Their circadian time was not considered to be a factor in the occurrence.

1.5.5 Air traffic controllers

All of the Nav Canada air traffic controllers involved with the SR 111 flight were current and qualified for their positions in accordance with existing Canadian regulations. The controllers were considered to be suitably experienced (see Table 4) and were being supervised as required. At the time of the occurrence, the workload of the controllers in the Moncton ACC was assessed as light. The initial SR 111 radio communications with Moncton ACC were handled by the high-level controller who, at 0118:11, handed off the ATS function to the terminal radar controller for the approach and landing at Halifax.

Table 4. Air traffic controllers' experience

	High-level controller	Terminal radar controller
Age	32	51
Licence	Air traffic control	Air traffic control
Experience as a controller	9 years	26 years
Experience as an IFR controller	9 years	26 years
Experience in present unit	3.5 years	26 years
Hours on duty before accident	5	8
Hours off duty before work period	72	16.25

1.6 Aircraft information

This section provides the following information:

• A general description of the occurrence aircraft; and
• A description of the operation, airworthiness, and maintenance of specific aircraft systems (environmental, automatic flight, warnings, communications, electrical, fire protection, etc.) and equipment deemed relevant to the occurrence investigation.

The systems and equipment described herein are specific to Swissair's MD-11 configuration and may not be accurate for other MD-11 configurations.

1.6.1 General

Table 5. General information about the occurrence aircraft (HB-IWF)

Manufacturer	McDonnell Douglas Corporation
Type and model	MD-11
Year of manufacture	1991
Serial number (SN)	48448
Certificate of airworthiness	Issued 28 July 1991
Total airframe time (hours)	36 041
Engine type (number of)	Pratt & Whitney 4462 (3)
Maximum take-off weight	285 990 kilograms (kg)
Recommended fuel types	Jet A, Jet A-1, JP-5, JP-8, Jet B
Fuel type used	Jet A

1.6.1.1 MD-11 design and configuration

The McDonnell Douglas MD-11 design project began in 1986. The MD-11 design is structurally based on the McDonnell Douglas DC-10 design (see Figure 1 and Figure 2). The MD-11 was designed for more economical and efficient operation than the DC-10, by incorporating modern, automated systems. The redesign automated most of the functions that were performed by the flight engineer in the DC-10, thereby allowing for a two-crew cockpit. The first MD-11 flight was on 10 January 1990 and delivery of the aircraft to the first customer was on 7 December 1990. The occurrence aircraft was manufactured in 1991 and was put directly into service by Swissair.

As the MD-11 was manufactured and certified in the United States (US) in accordance with applicable Federal Aviation Regulations (FAR), the regulatory focus of this report is directed toward the Federal Aviation Administration (FAA). Many civil aviation authorities (CAA) have drafted or harmonized their respective certification and continuing airworthiness regulations based on the FAA model; therefore, the issues in this report may also apply to other regulatory authorities.

The occurrence aircraft was configured with 241 passenger seats: 12 first class, 49 business class, and 180 economy class. The first- and business-class seats were equipped with an in-flight entertainment system,^{Footnote 11} certified and installed in accordance with a US FAA Supplemental Type Certificate (STC).

1.6.1.2 Weight and balance

Weight and balance calculations completed after the occurrence determined that the actual take-off weight for SR 111 was approximately 241 100 kg. The centre of gravity (C of G) was calculated to be 20 per cent mean aerodynamic chord (MAC). Other than very small differences, the post-occurrence calculations confirmed that the weight and balance calculations used for dispatch were accurate. The aircraft's weight was within limits, and throughout the flight the C of G was within the normal range (15 to 32 per cent MAC). The maximum allowable landing weight for the aircraft was 199 580 kg; the maximum overweight landing weight, allowable under certain conditions, was 218 400 kg. In an emergency, from an aircraft structural limit perspective, the aircraft can land at any weight; however, operational aspects, such as required stopping distance versus available runway distance, must be considered.

See the supporting technical information on this topic.

1.6.1.3 Aircraft coordinate system

The MD-11 fuselage comprises six major sections and two minor sections (see Figure 2). The major sections extend from Section B, the nose/cockpit area of the aircraft, to Section G, the aft fuselage section. The two minor sections, sections 6 and 5, were inserted fore and aft of Section E to extend the length of the original DC-10 fuselage. Each fuselage section consists of the external skin, internal circumferential frames, and longitudinal stiffening members (longerons and intercostals). Figure 2 also shows the locations of numerous manufacturing stations (STA), fuselage sections, the forward doors, lavatories (LAV), and galleys.

An X, Y, Z Cartesian coordinate system is used to identify any point within the aircraft.

• The X-axis extends laterally across the width of the aircraft. Lateral coordinates are measured in inches left or right of the fuselage longitudinal centre line. From the centre line toward the left wing, locations are positive coordinates (e.g., X= 80); locations toward the right wing are negative coordinates (e.g., X= −80).
• The Y-axis extends longitudinally from the nose to tail, is expressed in STAs, and is measured in inches aft of a designated point in front of the aircraft. For the MD-11, the tip of the nose of the aircraft is located at STA 239 and the cockpit door is located at STA 383.
• The Z-axis extends vertically through the aircraft. Vertical coordinates are measured in inches above or below the waterline (Z= 0), which, in the MD-11, is located 18 inches above the cabin floor. The cabin floor is therefore located at Z= −18.

1.6.1.4 Cockpit attic and forward cabin drop-ceiling areas–Description

The following section describes the cockpit attic and forward cabin drop-ceiling areas (see Figure 2, Figure 3, Figure 4, Figure 5, Figure 6, and Figure 7); the fire damage^{Footnote 12} and fire propagation in these areas is discussed in other sections of this report.

The space above the cockpit ceiling liner and the passenger cabin ceiling is referred to as the "attic" (see Figure 2). In Swissair MD-11 aircraft, the attic was divided at the cockpit rear wall. On the right side, the aluminum cockpit wall extended vertically to provide the division. On the left side, a single vertical smoke barrier was installed. (See Figure 3.)

The smoke barrier assembly above the left half of the cockpit rear wall consisted of a curtain made of nylon elastomer-coated cloth that was suspended from a curved aluminum alloy curtain rod. Hook-and-loop fastener^{Footnote 13} was used around most of the outer periphery of the cloth to attach it to the curtain rod, as well as to attach it to the adjacent aircraft structure along the bottom and right side. Thermal acoustic insulation blanket (insulation blanket) splicing tape was installed along the entire top edge of the smoke barrier to close gaps between the rod and the adjacent insulation blankets. The smoke barrier was designed with the following openings: three near the top of the curtain to permit the engine fire shut-off cables to pass through and two near the centre of the curtain to accommodate the installation of the cockpit air ducts.

Regulations require the installation of a smoke barrier between the cockpit and the rear of the aircraft in cargo and combination cargo/passenger configurations. However, there is no regulatory requirement to install smoke barriers in passenger aircraft, nor is there a requirement for the smoke barrier to meet a fire rating or fire blocking standard specific to a passenger aircraft application. Regardless, the barrier was certified to meet general aircraft material requirements and was installed in the aircraft during manufacture.

Examination of other Swissair MD-11 aircraft in the Swissair fleet disclosed that openings existed in the smoke barriers, and in areas adjacent to the barrier. Some of these openings were located at conduit and wire run locations that pass through or above the cockpit rear wall. The top edge of the rear, right cockpit wall near STA 383 has a cut-out in it to permit the passage of wire bundles and conduits. (See Figure 4 and Figure 5.)

Three 102-centimetre (cm) (40-inch) long conduits^{Footnote 14} and five wire bundles pass over the cockpit rear wall at this point, and continue aft over the top of Galley 2 between STA 383 and STA 420. (See Figure 3, Figure 4, Figure 5, and Figure 7.) The ends of the conduits were not required to be sealed and were found unsealed in other MD-11 aircraft that were examined. These conduits and wire bundles are attached by straps to a series of wire support brackets located at STA 383, 392, 401, 410, and 420. The wire bracket positioned at STA 383 is at a slight angle relative to the cockpit wall, which is directly below it. The top edge of this bracket, and attached wire bundles, are in contact with the metallized polyethylene terephthalate (MPET)-covered insulation blanket. Each of the conduits protrude forward of the cockpit wall by varying amounts because of the angle of the wall to the bracket.

Typically, the forward protrusion of the outboard conduit is the shortest of the three and the forward protrusion of the inboard conduit is the longest. These lengths, as measured from the bracket, vary from approximately 2.5 to 8 cm (1 to 3 inches) for the outboard and middle conduits. The inboard conduit was not used for any of the in-flight entertainment network (IFEN) installations. The cut-out extends downward approximately 8 cm (3 inches) from the top of the wall and is approximately 48 cm (19 inches) wide. A piece of closed-cell polyethylene foam containing fire retardant additives (i.e., part number (PN) NBN6718-83; Douglas Material Specification (DMS) 1954, Class 1, Grade 4101) is installed at this location to act as filler material for the cut-out.

Between STA 366 and STA 383 there are a number of wire support brackets installed in the fore-aft direction. These brackets are used to support wire bundles routed from behind the observer's station down into the avionics compartment; this area is commonly referred to as the "ladder area."^{Footnote 15} The aft end of the top bracket in the "ladder" is located near the outboard end of the cut-out in the cockpit wall (see Figure 3 and Figure 5). The brackets, and many of the wire bundles, are pressed up against, and closely follow, the curved contour of the fuselage over-frame MPET-covered insulation blankets.

Just aft of the right side of the cockpit rear wall, above Galley 2, a sound-suppression muff assembly (muff assembly) was installed around a splice junction of the conditioned air riser duct assembly (see Figure 6). The muff assembly uses an MPET-covered insulation blanket secured at both ends by hook-and-loop fasteners.

A second type of closed-cell polyethylene foam (PN ABE7049-41) was used around the windshield defog terminal blocks on the left side of the cockpit. A sample of the second type of foam (PN ABE7049-41) was removed from a Swissair MD-11 aircraft and tested. When the sample specimen was exposed to a small flame, the specimen ignited easily and burned.

Both of these foam materials were specified to DMS 1954, Class 1, Grade 4101, which states that the foam should possess fire-retardant additives and be certified to pass a 12-second vertical burn test as required in FAR 25.853, Appendix F. Literature indicates that both foams met FAR 25.853, Appendix F for commercial aircraft interior compartment components.

The manufacturer's material safety data sheet product code 37076 for the Dow Chemical Ethafoam® 4101, PN NBN6718-83, dated 23 August 1993, and current product information indicate that this polyethylene foam is combustible^{Footnote 16} and should not be exposed to flame or other ignition sources.

No foam was identified from the cockpit area of the occurrence aircraft.

In the Swissair MD-11s, the forward end of the muff assembly comes into close proximity to the lower right edge of the smoke barrier, and to the vent duct assembly for Galley 2. The galley vent duct, which is designed to exhaust odours and hot air from the galley when in operation, was not connected to the top of Galley 2, as Galley 2 was not electrically powered and not in service. A silicone elastomeric end cap was placed over the vent duct to close it off. The cap was located between the aft side of the cockpit rear wall and the forward side of one of the three riser ducts (see Figure 4 and Figure 6).

Five wire bundles and three conduits run aft from the cockpit and over the top of the riser duct assembly. The majority of the wire bundles descend from the wire support bracket at STA 420 to pass under the R1 door, flapper door ramp deflector. This drop in the wire bundles is generally referred to as the "waterfall" area (see Figure 7). Two of the wire runs, namely FDC and FBC, are clamped together and attached to a ceiling support tube located at approximately STA 427. This clamping arrangement is referred to in this report as a "marriage clamp." The ramp deflector is used to minimize the possibility of the forward right passenger door flapper panel from damaging adjacent wire assemblies if the flapper panel torsion spring should fail. The door flapper panel moves with the passenger cabin door when the door is raised or lowered.

1.6.2 Environmental (Air) system

1.6.2.1 General

Outside air is pressurized by each of the three engines. This pressurized air is bled off the engines to provide a source of heated and pressurized air to operate the various environmental subsystems, including the air conditioning packs and pressurization systems (see Figure 8). The three air packs are contained in compartments located to the left and right of the nosewheel well area. Each air pack supplies conditioned air to a common manifold located below the cabin floor.

Air from the common manifold travels through a self-contained distribution system of lines and ducts, and enters the cockpit and passenger areas via outlets located throughout the aircraft. Anomalies, such as leaking engine oil seals, can sometimes introduce contaminants, such as engine lubricating oil, into the bleed air system. Pyrolysis of these contaminants can give rise to potential smoke and odours in the conditioned air supply. Incidents where smoke or odours have entered the cockpit and passenger cabin through the bleed air system of commercial aircraft as a result of contamination have been reported frequently.

Air from the cockpit, passenger cabin, and the remainder of the pressure vessel^{Footnote 17} is vented overboard through an outflow valve located on the left side of the aircraft slightly ahead of the wing.

For normal operations, the air conditioning system is automatically controlled by the environmental system controller (ESC). The air system can also be operated manually by the pilots using the air systems control panel (ASCP) located in the overhead switch panel in the cockpit (see Figure 8 and Figure 11).

Insulation blankets are used extensively throughout the aircraft to wrap the air distribution ducts to provide a thermal barrier. They are also installed between all fuselage frames; in some areas a second layer is installed over the frames. These insulation blankets provide a barrier against hot or cold exterior temperatures, and noise that could otherwise enter the passenger cabin and cockpit.

See the supporting technical information on this topic.

1.6.2.2 Air distribution system–Cockpit and cabin

In the Swissair MD-11 configuration, conditioned air from the common air manifold located below the cabin floor is distributed to five zones through lines and ducts; Zone 1 is the cockpit and zones 2 to 5 are areas within the cabin (see Figure 8).

The ducts and lines continuously supply the cockpit with 500 cubic feet per minute (cfm) of conditioned fresh air regardless of the flow setting selected for the passenger cabin. The air enters the cockpit from numerous vents, including three outlets from the overhead diffuser assembly, window diffusers, overhead individual air outlets, and foot-warmer outlets (see Figure 8, Figure 9, and Figure 10). All of these cockpit vents can be fully closed with the exception of the centre overhead diffuser, which has a minimum fixed opening. Manually operated controls are used to regulate the airflow from the overhead diffuser assembly and the window diffusers. Three rotary controls for the overhead diffuser assembly are located at the rear of the overhead ceiling liner. The right window diffuser slide control is located in the right ceiling liner, above the first officer's position aft of the windscreen. The left window diffuser slide control is located in the left ceiling liner behind the captain's position, just inboard of the left aft window.

Air in the cockpit generally flows from the diffusers down and around the flight crew seats, then forward past the rudder pedals and into the avionics compartment below the cockpit floor. (See Figure 10.)

Although the incoming conditioned air from all three air packs is mixed in the common manifold before the air enters the distribution ducts, the proximity within the manifold of the Air Pack 1 inlet and the cockpit and Zone 5 outlets is such that an odour from Air Pack 1 could reach the cockpit and Zone 5 before reaching the other zones.

Conditioned air for the passenger cabin areas is ducted to overhead plenums and directed down toward the floor. This air circulates around the passenger seats, then migrates to airflow vent boxes located along both sides of the passenger cabin floor. Air from the airflow vent boxes is directed through under-floor tunnels to the outflow valve. The outflow valve consists of two small doors located on the lower left side of the fuselage at STA 920. These doors are regulated open or closed to control cabin pressurization.

1.6.2.3 Passenger cabin air system

The passenger cabin air system in the MD-11 is equipped with an economy (ECON) mode^{Footnote 18} that mixes fresh conditioned air with recirculated cabin air and distributes it to the cabin zones (see Figure 8). The cabin air system consists of four recirculation fans and one individual air fan, called a "gasper" fan, which are all located above the ceiling in the forward and centre cabin area. In the ECON mode, the recirculation fans draw air from above the ceiling. This air is then mixed with the fresh conditioned air supply before being distributed back into the passenger cabin. Normally, the four recirculation fans operate continuously, but can be manually turned off by selection in the cockpit of either the ECON switch, the CABIN BUS switch, or the SMOKE ELEC/AIR selector. The ESC will automatically shut off the recirculation fans when there is a demand for a lower cabin temperature or when a generator overload occurs.

The gasper fan provides a constant supply of air to the passengers' individual air outlets, and operates independently of both the ECON mode and the temperature selection. The gasper fan is turned off by selecting the CABIN BUS switch to the OFF position, or by selecting the SMOKE ELEC/AIR selector to the 3/1 OFF position.

There is a thumbwheel PAX LOAD selector on the ASCP to allow the pilots to input the number of passengers on board to the nearest 10. The ESC schedules the flow of conditioned air to the cabin based on this input. In the ECON ON configuration, the MD-11 air conditioning schedule is determined by combining 10 cfm of fresh air for each of the passengers, with 700 cfm from each of the four recirculation fans. Swissair chose to use a default setting of 260 passengers with all four recirculation fans operating. This default setting results in a mixed airflow of 5 400 cfm of fresh and recirculated air to the passenger cabin. In the ECON OFF configuration, the air conditioning schedule is set to 5 500 cfm to the passenger cabin.

Each of the recirculation fans and the gasper fan incorporates a high-efficiency particulate air filter (Donaldson Company PN AB0467286) constructed of pleated microglass fibre media with aluminum separators to maintain pleat spacing. The filter was life tested to the American Society of Heating, Refrigeration and Air Conditioning Engineers^{Footnote 19} Standard 52.1, meets military standard (MIL-STD)-282,^{Footnote 20} and is rated by its ability to capture and retain oil particles that are 0.3 micrometres (microns) in size.^{Footnote 21}

The filter is rated to remove 95 per cent of all 0.3 micron-size particles, and various capture mechanisms within the filter result in a higher efficiency in removing particles both smaller than, and larger than, 0.3 microns. For example, most tobacco smoke particulates, which are typically 0.01 to 1.0 micron in size, would be removed, as would larger particles, such as those produced when thermal acoustic insulation cover material burns.

During the initial stages of the fire on board the occurrence aircraft, the filter efficiency would have increased over time as particulates became entrapped in the filter. It would be expected that the filters would remove most of the smoke^{Footnote 22} particulates from the recirculated air during the initial stages of the in-flight fire. Although this filter is not classified as an odour-removing type, some odours associated with particulate contaminants would also be expected to be removed or diminished, while gaseous odours would be expected to pass through the filter.

1.6.2.4 Air conditioning–Smoke isolation system

If smoke or fumes are identified as coming from the air conditioning system, the flight crew are trained to use the Air Conditioning Smoke Checklist (see Appendix B). The checklist directs the flight crew to isolate the smoke source by selecting ECON OFF. If this does not isolate the smoke source, the next action on the checklist, after pushing the AIR SYSTEM push button to MANUAL, is to re-select ECON ON and select one of the air conditioning packs off. If this does not isolate the smoke source, the pack is selected back on and another pack is selected off. Each of the three air conditioning packs can be individually shut down to determine which of the three is the origin of the smoke. Air conditioning packs are shut down by selecting the air system to MANUAL, and then turning the appropriate air conditioning pack off on the ASCP; in turn, this closes the respective pack flow control valve. If the smoke decreases, the bleed air source for the air conditioning pack can be turned off, and the respective isolation valve can be opened.

1.6.3 Ditching mode

In the event that an emergency water landing is required, the aircraft can be configured for ditching by activating a DITCHING push button located to the right of the cabin pressure control panel on the overhead switch panel. When pushed, the switch provides a signal to the ESC, which then controls the various systems to prepare the aircraft for ditching. The existing cabin altitude is maintained during descent until the aircraft pressurization reaches zero differential, or until the aircraft descends through 2 500 feet, at which point the air packs are shut down. To maintain a watertight fuselage, the air pack ram air doors, the outflow valve, and the avionics and aft tunnel venturi valves are closed.

Examination of the SR 111 wreckage revealed that one air pack had been shut down. None of the other components expected to be closed if the DITCHING mode was selected were found in the ditching configuration. This would indicate that the DITCHING push button was not pushed; however, it could not be determined what effects the fire might have had on the serviceability of the associated systems.

1.6.4 Auto flight system

The MD-11 is equipped with an auto flight system (AFS) that is an integral part of the automatic and manual control system of the aircraft. The AFS consists of two, dual-channel flight control computers (FCC) with two integrated autopilots, flight directors (FD), autothrottle, and engine trim controls. Manual override of the automatic flight controls and autothrottle is always available.

The AFS hardware consists of the two FCCs, a dual-channel flight control panel (FCP), an automatic flight system control panel, a duplex flap limit servo, a duplex elevator load feel servo, a duplex autothrottle servo, and two control wheel force transducers. The AFS provides fail-operational Category IIIB auto-land through ground roll-out, and integrated windshear detection/warning with autopilot, FD, and autothrottle guidance escape capability.

The FCP, located on the glareshield control panel, provides the interface between the flight crew, the AFS, and the flight management system (FMS). The AFS incorporates airspeed and flight path protective features that automatically override the selected airspeed or flight path commands or both to prevent over or under speed.

Each dual-channel FCC has two similar functioning lanes. Each lane has two central processing units, which continually monitor the health of the other lane. A detected fault in the operating lane will automatically disconnect that function. For example, an autopilot fault will result in the autopilot disconnecting. Should this happen, the autopilot disengage warning system would activate a flashing red "AP OFF" alert on the flight mode annunciator and a cyclic (warbler) aural warning tone. The warbler can be reset, after at least one cycle of the tone has been completed, by pushing either of the autopilot disconnect switches installed on the outboard horn of both control wheels or by re-engaging the autopilot.

Each FCC receives inputs from the following sources:

• Inertial reference units 1, 2, 3 (IRU-1, -2, -3);
• Air data computers 1, 2 (ADC-1, -2);
• Radio altimeter 1, 2 (RA-1, -2);
• Both instrument landing systems (ILS), Flight Management Computer 1, 2 (FMC-1, -2);
• All three full-authority digital electronic control (FADEC) engine control units, flight control sensor data, selected references from the FCP; and
• Other information, such as weight on wheels, and gear and flap position.

The FCCs send digital signals to the electronic instrument system (EIS) for display, and control signals to actuators for control of pitch, roll, yaw, and engine thrust.

1.6.5 Electronic instrument system

The MD-11 EIS consists of six display units (DU) mounted in the instrument panel. DUs 1, 2, and 3 are on the left side; DUs 4, 5, and 6 are on the right side (see Figure 11). The captain's DUs (DUs 1, 2, and 3) receive display information from display electronic unit (DEU) 1, and the first officer's DUs (DUs 4, 5, and 6) receive information from DEU 2. DEU 3 (auxiliary) is continuously available as a spare and may be selected for use by either pilot through the EIS source input select panel.

DUs 1 and 6 normally display primary flight information, such as heading, attitude, airspeed, barometric and radio altitude, vertical speed, vertical and lateral deviation, aircraft operating limits, configurations, and flight modes.

DUs 2 and 5 are normally navigation displays (ND). The ND has four modes of operation as follows:

• MAP mode–Displays the active flight plan referenced to the aircraft position and heading in the form of a pictorial representation; this is the mode normally used with FMS navigation.
• PLAN mode–Displays the flight plan only, with the aircraft symbol centred on the next waypoint.
• VOR mode–Displays a compass rose, two bearing pointers (for non-directional beacons (NDB) and very high frequency omni-directional range (VOR)), a course deviation indicator (for VOR navigation and approaches), headings, ground speed, true airspeed (TAS), distance measuring equipment, and weather information; this mode is normally used for conventional (NDB and VOR) navigation and approaches.
• APPR mode–Displays the same information as the VOR mode, except that the course source is an ILS receiver instead of a VOR; this mode is used for ILS front-course and back-course approaches.

All the modes display wind, clock, and next waypoint information.

DU 3 is normally used to show the engine and alert display (EAD), which includes information such as engine pressure ratio (EPR), exhaust gas temperature, N₁,^{Footnote 23} N₂,^{Footnote 24} fuel flow, and alert messages. DU 4 is used for the system display (SD), which normally shows either secondary engine data (i.e., engine oil temperature, pressure and quantity), or aircraft systems synoptic pages.^{Footnote 25} The synoptic pages display the configuration and status of the hydraulic, electric, air, and fuel systems. They also include a configuration page, miscellaneous page, systems status page, and a consequence page (see Table 6).

Electrical power is supplied by the left emergency 115 volts (V) alternating current (AC) bus for DUs 1 and 3; by the right emergency 115 V AC bus^{Footnote 26} for DUs 4, 5, and 6; and by the 115 V AC Bus 1 for DU 2. If all three engine-driven electrical generators were to fail, DU 1 and DU 3 would automatically receive electrical power from the aircraft battery. When the air-driven generator (ADG) is deployed and selected to the electric mode, DUs 1, 3, 4, 5, and 6 can be powered, and the aircraft battery charge will be maintained.

If flight information data to the DU is invalid, that information is removed from the screen and replaced by either a red or amber "X" symbol covering the area of removed data. A red "X" requires immediate flight crew action to restore the lost data. If the "X" is amber the flight crew can decide to delay action to restore the data. A failed DEU is indicated by a red "X" displayed across the entire black screen of the DU. The loss of electrical power to a DU will result in a blank screen. The loss of any DU would cause the remaining DUs to reconfigure automatically. The priority logic used in reconfiguring is to keep a primary flight display (PFD) available at all times; that is, if only one DU were functioning, it would maintain the PFD. In the failure priority logic, the second-to-last operating DU would display the EAD.

1.6.6 Flight management system

The FMS is used for flight planning, navigation, performance management, aircraft guidance and flight progress monitoring. The FMS provides a means for the flight crew to select various flight control modes via the FCP, and the means to enter flight plans and other flight data via the multifunction control display unit (MCDU) (see Figure 11). Flight progress is monitored through the MCDU and the EIS.

After data entry by the flight crew, the FMCs will generate a flight path profile; for example, from the origin airport to the destination airport. The FMC then guides the aircraft along that profile by providing roll commands, mode requests, speed and altitude targets, and pitch commands (while "on path" during descent) to the FCCs.

The FMC navigation database includes most of the information that is available to pilots from navigation charts and approach charts. The flight plan that was entered into the FMS before departure from JFK airport in New York did not include the Halifax International Airport. Therefore, when the pilots decided to divert and land at the Halifax airport, some reprogramming of the FMS would have been required. Before the pilots could select an instrument approach from the FMC database, the new destination of Halifax would have to be programmed into the FMS.

The MD-11 is not certified to conduct back-course approaches using the FMS. The FMS will prevent the display and selection of back-course approaches from the navigation database.^{Footnote 27} Conventional navigation and approach methods are available to the flight crew.

See the supporting technical information on this topic.

1.6.7 Warnings and alerts

The MD-11 alerting system incorporates master warning and master caution lights on the glareshield. Alerts are displayed in the cockpit on the EAD, the SD, or both. Alerts are categorized into four levels (3, 2, 1, and 0) and are presented in three columns in the lower third of the EAD.

Level 3 (red) alerts indicate emergency operational conditions that require immediate flight crew awareness and immediate corrective or compensatory action by the pilots. All Level 3 alerts have an aural warning. Level 2 (amber) alerts indicate abnormal operational system conditions that require immediate flight crew awareness and subsequent corrective or compensatory action by the pilots. Level 1 (amber) alerts may require a maintenance action prior to take-off, a logbook entry, or confirmation of desired system configuration. A Level 1 (amber) alert in flight may require flight crew action as prompted, and requires an aircraft logbook entry. Level 0 (cyan) alerts usually indicate operational or aircraft systems status information.

If a system generates an alert or warning, the applicable cue switch on the system display control panel (SDCP) illuminates, enabling the pilots to identify the system. Activating the illuminated system cue switch on the SDCP produces the associated system synoptic page on the SD, and extinguishes the cue light, master warning, and caution lights, if they are on. Table 6 shows available cue switches and their associated systems synoptic page.

Table 6. Cue switches and associated systems synoptic pages

Cue switch	Associated systems synoptic page
ENG	engine
HYD	hydraulic system
ELEC	electrical system
AIR	air system
FUEL	fuel system
CONFIG	flight controls and landing gear
MISC	alerts and consequences for various miscellaneous systems

The FDR revealed that the air system synoptic page (Air Page) was selected by the pilots sometime between 0111:49 and 0112:52, shortly after the unusual odour was first detected in the cockpit. This page displays environmental system operation of the manifolds, duct temperatures, zone temperatures, smoke and heat detectors in the cargo compartments, pressurization readouts, bleed-air readout, and air conditioning pack readouts. Aside from the flight crew selection of the Air Page, the FDR records only the following potentially related data: air packs 1, 2, and 3 OFF; aft and forward cargo heat; bleed-airs 1, 2, and 3 OFF; cabin pressure warning; and cabin altitude warning. The FDR does not record individual duct or zone temperatures, cabin smoke, lavatory smoke, or any system cues displayed on the SDCP.

1.6.8 Standby flight instruments

Two standby flight instruments (one that displays the aircraft's attitude, and one that displays the aircraft's altitude and airspeed) are located in the centre of the lower instrument panel for use by the captain or first officer (see Figure 11). There was no provision for a self-contained, independent electrical power supply for standby communication and electronic navigation capability, nor was this required by regulation.

The standby attitude indicator (SAI), sometimes referred to as a gyro horizon, provides a vertical, stabilized reference that makes it possible to visually monitor the aircraft's attitude, in pitch and roll, with respect to the horizontal plane. The SR 111 SAI was self-contained and electrical power was being supplied by the aircraft's battery bus. A warning flag appears on the face of the instrument if electrical power to the unit is lost or removed, or if the gyro speed decays to a predetermined speed below which the gyro has insufficient rotational speed to provide reliable information.

The standby altimeter and airspeed indicator are combined in one instrument. They are connected to the auxiliary pitot and alternate static systems, and do not require electrical power to perform their intended function; electrical power is required for the vibrator that prevents the pointers from sticking.

Primary power for the two standby instruments' integral lights  was being supplied by the 115 V AC Bus 1 (phase B) circuit breaker (CB) B-523 (labelled MAIN & PED INSTR PNL LTG) located on the lower main CB panel at position A-13. The wiring for the primary electrical power circuit integral lights runs below the cockpit floor and not through any area where heat damage^{Footnote 28} was observed; therefore, there is no reason to suspect that these lights ceased to function. Back-up electrical power for the integral lights was supplied by the left emergency AC bus.

A direct-reading, standby magnetic compass (see Figure 11) is installed in the cockpit forward of the overhead panel on the windshield centre post. The instrument does not require electrical power to operate. Electrical power for lighting of the compass  was supplied by the 28 V direct current (DC) Bus 1. The switch for the compass light is on the overhead switch panel, near the compass. The standby compass is normally kept in a stowed position with the light off. As is the case with all direct-reading magnetic compasses, the accuracy of the instrument in the MD-11 is degraded when the aircraft is accelerating or decelerating, and when the aircraft is not in straight and level flight.

See the supporting technical information on this topic.

1.6.9 Communications systems

1.6.9.1 General

For external communications, Swissair MD-11 aircraft are equipped with five separate radios, plus an emergency hand-held very high-frequency (VHF) radio stored in a bracket mounted on the cockpit rear wall. The five radios comprise three VHF radios and two high-frequency (HF) radios, all of which are controlled through communication radio panels installed in the aft pedestal between the two pilots seats.

Internal voice communication between the pilots is either spoken directly or through boom microphones attached to headsets. Each flight crew oxygen mask has a built-in microphone that is activated with a push-to-talk rocker switch. One position of the rocker switch is used for internal communication, and the other position is used for transmitting over the external VHF and HF radios. Additional internal communication is provided through a flight interphone system that connects all cabin attendant stations and the cockpit, and a passenger address (PA) system that enables the pilots and cabin crew to address passengers throughout the cabin and in the lavatories.

The ambient noise in the MD-11 during high-altitude cruise flight is low enough so that pilots typically do not need to use the headsets and boom microphones for internal communications. Swissair policy requires flight crews to use this equipment for flight below 15 000 feet. There are regulatory requirements in some jurisdictions that mandate the use of this equipment below certain altitudes. For example, US FAR part 121.359 (g) mandate their use below 18 000 feet for aircraft equipped to record the uninterrupted audio signal received by a boom or mask microphone in accordance with FAR part 25.1457 (c)(5). Canadian Aviation Regulations (CARs) (CAR 625.33 II (5) refers) require their use below 10 000 feet.

See the supporting technical information on this topic.

1.6.9.2 Interphone call system

The aircraft was equipped with an interphone call system to facilitate aircraft crew communication. In Swissair MD-11s, handsets, call buttons, and reset switches are installed at nine stations throughout the aircraft: one in the cockpit and one at each flight attendant station. Calls can be initiated from any flight attendant station to the cockpit; from the cockpit to any, or all, flight attendant stations; and from any flight attendant station to any, or all other, flight attendant stations.

The interphone call system provides both aural and visual signals to alert crew members to a station call. A visual alert is provided by the illumination of indicating lights in the reset switches. In the passenger cabin there is an additional visual alert through the use of pink call lights. At the associated area master call display, these lights would illuminate to indicate the initiation of a "pilot-to-flight-attendant" or "flight-attendant-to-flight-attendant" call. When the call button is pushed, two electro-mechanical chimes, one above the left and one above the right attendant station emit a single-stroke chime.

All cabin interphone conversations are recorded on a single cockpit voice recorder (CVR) channel. The CVR recording does not indicate which station is being used.

1.6.9.3 Aircraft communications addressing and reporting system

The occurrence aircraft was equipped with an aircraft communications addressing and reporting system (ACARS), which is a two-way digital communications link between the aircraft and the operator's flight operations centres. Typically, when the aircraft is within VHF radio range of a ground station the ACARS uses the aircraft's VHF 3 radio to communicate through a network system.

See the supporting technical information on this topic

The ACARS switches automatically to communicate through a satellite communications (SATCOM) system when the aircraft is out of range of VHF ground stations, VHF coverage is interrupted through saturation of the system, or the VHF 3 radio in the aircraft is switched to voice mode. When VHF coverage is available, VHF is the primary path for data exchange. The SATCOM system also provides satellite telephone service available to all aircraft occupants.

The ACARS provides a means to automatically report flight information, such as engine parameters and load data, and to track aircraft movements, such as take-off and landing times. The pilots can also use the ACARS to obtain information, such as weather reports, and to exchange free-text messages.

Swissair's main service provider for the ACARS was Société Internationale de Télécommunications Aéronautiques (SITA). All communications to and from the aircraft through SITA were routed through the SITA Swissair host in Zurich. Where SITA was not able to maintain coverage, they subcontracted to Aeronautical Radio Inc. (ARINC), which is the main service provider in the USA, and to the International Maritime Satellite Organization (INMARSAT) for satellite coverage.

1.6.10 Electrical system

1.6.10.1 General

Normal primary electrical power is generated by three, engine-driven, integrated-drive generators (IDG). An auxiliary power unit (APU) generator is also available as a back-up source of electrical power in certain ground or flight phases. The three IDGs supply electrical power to their respective generator buses,^{Footnote 29} which in turn supply electrical power to several sub-buses located throughout the aircraft. Electrical power distribution is normally automatic; however, if necessary, the pilots can control the electrical system manually with controls located on the overhead switch panel.

The following definitions are used throughout the report. They are based on the Society of Automotive Engineers' (SAE) Aerospace Standard AS50881, Rev. A, entitled Wiring, Aerospace Vehicle:

• Wire: A single metallic conductor of solid, stranded, or tinsel construction designed to carry current in an electric circuit, but not having a metallic covering, sheath, or shield. For the purpose of this report, "wire" refers to "insulated electric conductor."
• Cable: Two or more wires contained in a common covering, or two or more wires twisted or moulded together without a common covering, or one wire with a metallic covering shield or outer conductor.
• Wire bundle: Any number of wires or cables routed and supported together along some distance within the aircraft.
• American Wire Gauge (AWG): A standard set of non-ferrous wire conductor sizes. "Gauge" is based on diameter. The higher the gauge number, the smaller the diameter and the thinner the wire.

See the supporting technical information on this topic.

1.6.10.2 Air-driven generator

The ADG is an air-powered turbine that drives an electrical generator. The ADG is manually deployed via a lever in the cockpit; once deployed, it cannot be retracted in flight. The ADG is located on the lower right-hand side of the fuselage to the right of the nose gear doors.

When deployed, the ADG automatically supplies hydraulic power for the flight controls by electrically powering auxiliary Hydraulic Pump 1. With a switch on the electrical system control panel (SCP), the pilots can switch the ADG to an electrical mode of operation. In doing so, the ADG supplies emergency electrical power that operates instruments and communication equipment. In this configuration, electrical power is no longer supplied to auxiliary Hydraulic Pump 1; in the absence of primary power, the pump will cease to operate.

On the occurrence aircraft, the ADG was stowed at the time of impact. There would have been no requirement to deploy the ADG unless electrical or hydraulic power or both were unavailable from other sources. Information derived from the examination of various system components indicates that, at the time of impact, electrical and hydraulic power were available from sources other than the ADG.

See the supporting technical information on this topic.

1.6.10.3 Emergency electrical power isolation

For the purpose of isolating a source of smoke, electrical power can be shed in sequence from the electrical buses through the four-position SMOKE ELEC/AIR selector located on the overhead electrical control switch panel (see Figure 11). This selector allows for the isolation of electrical or air conditioning systems that could be the source of fumes or smoke.

The selector must be pushed in and rotated clockwise to move it to the next position. The selector cannot be turned counter-clockwise. As the selector is rotated, electrical power is returned to the systems associated with the previous position prior to shutting off electrical power associated with the new selector position. If the selector is rotated through to the NORM position, all electrical power from the three generator systems is returned, and the three air systems are restored.

1.6.10.4 Cockpit circuit breaker panels

There are nine separate CB panels in the cockpit; the five most pertinent to this investigation are the overhead CB panel, the upper and lower avionics CB panels, and the upper and lower main CB panels (see Figure 12). The remaining four are the captain's and first officer's console CB panels, the centre overhead integral lighting CB panel, and the lower maintenance CB panel.

The overhead CB panel contains wiring from the following six separate buses:

• 28 V DC battery bus;
• 28 V DC battery direct bus;
• left and right emergency AC buses; and
• left and right emergency DC buses.^{Footnote 30}

The upper avionics CB panel contains wiring from the following seven separate buses:

• 115 V AC buses 1 and 3;
• 28 V DC buses 1 and 3; and
• 28 V AC 1, 2, and 3 instrument buses.

The lower avionics CB panel contains wiring from the following two separate buses:

• 28 V DC Bus 2; and
• 28 V DC ground bus system.

The 28 V DC ground bus system CBs, installed on the lower avionics CB panel, were all 0.5 ampere (A) CBs used for indication and control of their respective remote control CBs. The 28 V DC Bus 2 consisted of three, 3 A and one, 5 A CBs. A jumper wire from the line side of the "SLAT CONTROL PWR B" CB, which was a 3 A CB, was used to provide 28 V DC to a 1 A CB used to power the IFEN control relays. The four, 115 V AC three-phase power supply 15 A CBs for the IFEN were installed in the lower avionics CB panel.

The upper and lower main CB panels contain wiring from both the 115 V AC and 28 V DC buses 1, 2, and 3.

The standard used by the aircraft manufacturer for CB identification was to identify each row by a letter, and each column by a number. This methodology was used to identify the location of individual CBs on the panel.

1.6.10.5 Overhead circuit breaker panel bus feed wires

These bus feed wires were routed through five conduits that were installed along the right side of the fuselage, from the avionics compartment to approximately halfway up the fuselage side wall. In the cockpit, outside of the conduits, the bus feed wires were individually clamped to wire support brackets that were attached to the aircraft structure by nylon standoffs. The individual wires were bundled together, just prior to entering the right side of the overhead CB panel. Table 7 describes the bus feeds.

Table 7. Overhead CB panel bus feeds

Bus feed	Right emergency AC bus, phases A, B, and C	28 V DC battery direct and battery buses	Left emergency AC bus	Right emergency DC bus	Left emergency DC bus
Wire harness number	ABS9208	ABS9206	ABS9205	ABS9206	ABS9205
Wire run letter	ALB	ALN	ALC	ALP	ALE
Wire size	3–#8AWG	1–#8AWG 1–#6AWG	1–#10AWG	1–#6AWG	1–#6AWG
Function	115 V right emergency AC bus, Phases A, B, and C	28 V DC battery direct and battery buses	115 V left emergency AC bus	28 V right emergency DC bus	28 V left emergency DC bus

1.6.10.6 Upper and lower avionics circuit breaker panel bus feed wires

The 115 V AC bus feeds originate in the Centre Accessory Compartment and the 28 V DC bus feeds originate from the avionics compartment. The three 28 V AC instrument bus feed wires originate from instrument transformers that are mounted on the aft face of the cockpit wall. Primary electrical power to these transformers is supplied from the lower main CB panel 115 V AC buses 1, 2, and 3 respectively.

All of the bus feed wires supplying the avionics CB panel are routed from the right aft side of the cockpit wall, forward through a hole behind Galley 2, and then inboard to the avionics CB bus bars.

The HF Comm 1 requires a three-phase electrical power source to operate. As a result, two additional 115 V AC Bus 1 feed wires (phases B and C) are routed to the HF Comm 1 CB. Similarly, an additional DC Bus 2 feed wire is routed to two CBs: the AFCS MISC PNL LIGHTS and the PRIMARY HOR STAB TRIM. Table 8 describes the main bus feed wires and their run letters.

Table 8. Avionics bus feed wires and run letters

Function	115 V AC Bus 1	115 V AC Bus 3	28 V DC Bus 1	28 V DC Bus 3	28 V AC Instr–1	28 V AC Instr–2	28 V AC Instr–3
Wire number	B110-7-8A	B110-22-8A	B117-3-8	B117-1-8	B108-5-16	B108-7-16	B107-9-16
Wire run letter	AEU	AEV	ASD	ASE	ASC	ASC	ASC

1.6.10.7 Upper and lower main CB panel bus feeds

The upper and lower main CB panels receive electrical power from bus feed wires that are routed from the avionics compartment located below the floor; these bus feed wires were not routed through any area where heat damage was observed.

1.6.10.8 Wire identification, location, and routing

All McDonnell Douglas-installed wires in the MD-11 are identified by a wire number consisting of an alpha character followed by a numeric string (e.g., B203-974-24). The alpha character designates the aircraft section in which the wire is installed (see Section 1.6.1.3). The six digits that follow identify the individual wire number; the final two digits identify the wire gauge. Therefore, wire B203-974-24 indicates that the wire is installed in the B section, that its individual wire number is 203-974, and that it is a 24 AWG wire. An N suffix indicates a ground wire.

Typically, wires that are installed in aircraft are tied together in bundles called wire runs. Therefore, individual wires can be further referenced by identifying the wire run in which they are included.

In the MD-11, every wire run is identified by a three-letter designator, such as "FBC," which provides information about where and how the wire run is routed through the aircraft.

• The first letter indicates the location of the wire run in the aircraft. Letters A, B, C, R, Q, and S are used for the cockpit and nose area. Letters D, E, and H refer to the fuselage section below the floor. Letters F, G, and J refer to the cabin above the floor. The letter K identifies the right wing. The letter L identifies the left wing. Letters T and V identify the tail location.
• The second letter indicates whether the wire run is enclosed in a conduit or in an open wire bundle. The letters V, W, Y, and Z are used if the wire run is in a conduit; all other letters indicate an open wire bundle. The second letter also indicates the applicable RF interference category of the wires in the bundle.
• The third letter identifies the specific run.

Where practical, the wire number is directly marked on the outer insulation of each wire; otherwise, the wire number is affixed to the wire by tags at both the start and termination points. A wire may need multiple sets of run letters to completely describe its routing through the aircraft.

Once a wire number is known, it is possible to use the manufacturer's wire list to determine where the wire is installed in the aircraft. The wire list also provides information about the wire's composition, length, to-and-from termination points, circuit function, and wire run affiliation.

1.6.10.9 Wire description–MD-11 aircraft

1.6.10.9.1 Selection criteria for wires–Douglas aircraft company

In accordance with FAR 25.869, the only certification test required for aircraft wires is the 60-degree Bunsen burner test (see Section 1.14.1.2). Aircraft manufacturers typically perform additional wire tests to meet manufacturing and customer requirements, and select wire types based on a balance between the characteristics of the wire types available and the required application.

In 1976, Douglas Aircraft Company (Douglas) was informed by its wire supplier that the general purpose wire they were providing for the wide body aircraft program was going to be discontinued. Douglas initiated a wire evaluation program to select a new general purpose wire. The review included an assessment of various wire insulation types with respect to their electrical, mechanical, chemical, and thermal properties, along with their inherent flame resistance and smoke production characteristics. The evaluation resulted in two types of insulation being selected: a modified cross-linked ethylene-tetrafluoroethylene (XL-ETFE)^{Footnote 31} in accordance with Douglas specification BXS7008 and an aromatic polyimide,^{Footnote 32} hereinafter referred to as polyimide, in accordance with Douglas specification BXS7007.

Polyimide insulation was viewed as having favourable weight and volume characteristics. Also, it offers superior resistance to abrasion, cut-through, and fire. Polyimide does not flame or support combustion. The limitations of polyimide included less resistance to arc tracking^{Footnote 33} and less flexibility than other insulation types. Polyimide insulation is an amber-coloured film that is wrapped on the wire. In some cases, a modified aromatic polyimide resin coating was applied over the polyimide film to provide a suitable topcoat surface to allow the wire identification number to be directly marked on the wire. This topcoat appears dull yellow in colour.

In 1975, the FAA issued a Notice of Proposed Rulemaking (NPRM)^{Footnote 34} stating that for wire, the specific optical density^{Footnote 35} requirement for smoke emission would be a value of 15 (maximum) within 20 minutes after the start of the test. Although this NPRM was expected to be adopted, it was terminated without affecting the existing rules. However, before the NPRM was terminated, Douglas testing showed that the polyimide insulation would pass the specific optical density test requirements and that the XL-ETFE would not.

Based on cost and other considerations, Douglas chose XL-ETFE for its BXS7008 general purpose wire insulation, and used XL-ETFE in the DC-10. At the same time, polyimide insulation in accordance with BXS7007 was selected for the pressurized passenger section primarily because it produced less smoke when exposed to heat or flame compared to XL-ETFE. Polyimide could also be used in special applications, such as in locations where the temperature exceeded 150°C (302°F), whereas XL-ETFE was not rated for such temperatures.

In the early 1980s, a crimping problem was discovered with wires that had XL-ETFE insulation and tin-coated copper conductors. Because of this, Douglas decided to switch to nickel-coated conductors, even though they were more expensive. Subsequently, XL-ETFE lost its cost advantage, and Douglas switched to polyimide-insulated, nickel-coated conductors for all its general purpose wire.

In 1991, a US Air Force wire evaluation program identified a suitable general purpose wire replacement. It was a composite insulation made from polytetrafluoroethylene-polyimide-polytetrafluoroethylene (PTFE-PI-PTFE). That same year, Douglas initiated another wire evaluation program, using the polyimide general purpose wire as its baseline for comparison testing of other wire insulations types. The testing showed that the PTFE-PI-PTFE insulation performed as well as or exceeded the polyimide insulation; Douglas selected the PTFE-PI-PTFE insulation, in accordance with DMS 2426, for its general purpose wire in 1995.

Table 9 shows the comparative properties of four wire insulations.

Table 9. Comparative properties of wire insulation systems^{Footnote 36}

Relative ranking	Most desirable -------- to -------- Least desirable
	1	2	3	4
Weight	PIa	ETFEb	COMPc	PTFEd
Temperature	PTFE	COMP	PI	ETFE
Abrasion resistance	PI	ETFE	COMP	PTFE
Cut-through resistance	PI	COMP	ETFE	PTFE
Chemical resistance	PTFE	ETFE	COMP	PI
Flammability	PTFE	COMP	PI	ETFE
Smoke generation	PI	COMP	PTFE	ETFE
Flexibility	PTFE	ETFE	COMP	PI
CreepFootnote 37 (at temperature)	PI	COMP	PTFE	ETFE
Arc propagation (arc tracking) resistance	PTFE	ETFE	COMP	PI

1. PI–MIL-W-81381/7 (aromatic polyimide)
2. ETFE–MIL-W-22759/16
3. COMP–MIL-W-22759/80-92 (PTFE-PI-PTFE)
4. PTFE–MIL-W-22759/80-92

1.6.10.9.2 MD-11 wire specification

Douglas identified the following two general purpose wire specifications for the MD-11: BXS7007 and BXS7008 (see Figure 13). These wire specifications adopt by reference, unless otherwise indicated, certain government-furnished documents, including Military Specifications and Standards and Federal and Industry Standards, as well as certain Douglas Material and Process Specifications. BXS7007 and BXS7008 also establish performance and test requirements that the wires must meet in addition to those adopted from the referenced documents, including, for example, the 60-degree burn test required by FAR 25.869.

BXS7007 specification is entitled "Wire, Electric, Copper & Copper Alloy, Polyimide Tape Insulated, 600 Volt." This specification covers wires and cables that must pass all the applicable performance and test requirements for the specified gauges as defined in MIL-W-81381, MIL-W-81381/12, and MIL-W-81381/14, as well as MIL-W-27500 and other referenced documents, unless otherwise indicated in the specification. Douglas started using the BXS7007 wire in production aircraft in 1980.

Wires that conform to BXS7007^{Footnote 38} are polyimide insulated with nickel-plated conductors. All BXS7007 wire conforms to the requirements of MIL-W-81381/12 (in addition to other applicable requirements), except for 24 AWG wire, which is high-strength alloy that conforms to the requirements of MIL-W-81381/14 (in addition to other applicable requirements). All BXS7007 wire is rated at 200C, 600 volts. The temperature rating refers to the maximum temperature in which the wire may be used, and is derived by combining ambient and wire-generated heating.

BXS7008 specification is entitled "Wire, Electric, General Purpose, Copper & Copper Alloy, Fluoropolymer Insulated."^{Footnote 39} This specification covers wires and cables that must pass all the applicable performance and test requirements for the specified gauges as defined in MIL-W-22759, MIL-W-22759/34, and MIL-W-22759/42, as well as MIL-W-27500 and other referenced documents, unless otherwise indicated in the specification (see Figure 13). Douglas started using the BXS7008 wires in production aircraft in 1977.

Wires that conform to BXS7008 are insulated with modified, XL-ETFE. BXS7008 requires that the insulation be applied or extruded on the conductor in two layers of contrasting colour to aid in the identification of insulation damage. Wires 22-00 gauges are tin-coated copper. These wires must conform to MIL-W-22759/34 and are rated at 150°C, 600 volts. BXS7008 24 gauge wire is nickel-coated high-strength copper alloy. This wire must conform to MIL-W-22759/42 and is rated at 200°C, and 600 volts.

MIL-W-27500, which is one of the documents adopted in both BXS7007 and BXS7008 unless otherwise indicated, covers requirements for special purpose cables and electrical power cables, including the basic wire size and type, number of wires, and shield and jacket styles. BXS7007 and BXS7008 also adopt documents requiring identification coding of wires.

In the areas of SR 111 where the fire occurred, it is estimated that more than 95 per cent of the wiring installed at the time of manufacture was BXS7007 (i.e., polyimide insulated wire). Douglas also used various other types of wire, in small amounts, where a specific requirement existed.

1.6.11 In-flight entertainment network

1.6.11.1 Description

The IFEN system combined computer, video, and audio technologies to allow passengers to select movies, audio, games, news, gambling, and the moving map display through an interactive seat video display. The IFEN was to be configured to give all passengers access to a variety of "on-demand" entertainment and information choices, with touch-screen control. The original design, for the Swissair MD-11, provided full IFEN access to 257 passenger seats, which included all cabin classes; however, only the first two aircraft were configured to have the IFEN available in all 257 seats. For economic reasons, in April 1997, Swissair decided to reduce the IFEN configuration to include only first- and business-class seats.

See the supporting technical information on this topic.

The IFEN system was installed in the first- and business-class passenger sections of HB-IWF between 21 August and 9 September 1997 (see Figure 14). Although the 49 business-class seats were installed at that time, because of delivery delays, the 12 IFEN-equipped first-class seats were not installed until February 1998. The economy-class passenger section was not configured with the IFEN, even though electrical cabling and equipment rack supports were installed for that section. HB-IWF was the eighth Swissair MD-11 to be equipped with the IFEN system.

See the supporting technical information on this topic.

1.6.11.2 Wiring installation

The IFEN system, as configured in HB-IWF, required 4.4 kilovolt-amperes of 115 V AC three-phase 400 hertz aircraft power according to the Hollingsead International (HI) electrical load analysis (ELA) 20032 revision (Rev) B. The main power supply cable for the IFEN system consisted of three 8 AWG, MIL-DTL-16878/5-BNL wires twisted together. This cable originated at an electrical terminal strip located in the avionics compartment and was terminated at a 15 A three-phase CB located on the lower avionics CB panel (see Figure 14 and Figure 15). This 15 A CB, identified as "RACK1 PS1," provided aircraft power by means of jumper wires^{Footnote 40} to three adjacent 15 A three-phase CBs located on the lower avionics CB panel. Each of these four 15 A CBs provided aircraft power to one of the four IFEN power supply units (PSU). The PSUs used a series of capacitors and internal electronics to convert the 115 V AC aircraft system power to 48 V DC output power, used by the IFEN system components.

Each of the four 15 A IFEN CBs was connected to its respective PSU by one of four PSU cable assemblies, hereinafter referred to as PSU cables; each PSU cable consisted of three 12 AWG, MIL-W-22759/16/12 wires twisted together.

Additionally, a 1 A CB was installed on the lower avionics CB panel. The CB provided 28 V DC power, by means of a 16 AWG wire (hereinafter referred to as 16 AWG control wire), to the IFEN relay assembly located in the ceiling above Galley 8. This 1 A CB, identified as "IFT/VES 28V," received 28 V DC aircraft power by means of a jumper wire from the line side of the adjacent CB, "SLAT CONTROL PWR B," and was used to control the 48 V DC output of the four PSUs through the IFEN relay assembly. Pulling this CB removed the 48 V DC output power from the PSUs; however, pulling the CB would not remove the 115 V AC input power to the PSUs.

The four IFEN PSU cables (PSU 1, 2, 3, 4) and the 16 AWG control wire were routed rearward along the lower avionics CB panel. In this area, they were attached to the main IFEN power supply cable with nylon self-locking cable ties. This IFEN wire bundle was then cable tied to the DC CB ground bus bar at the lower avionics CB panel and, in some installations, held in place near the rear of the panel by a clamp. The wire bundle was then directed upward until it separated in two directions. The main power supply cable looped downward, passing through a conduit along the right side of the fuselage into the avionics compartment. The four PSU cables and the 16 AWG control wire, now in their own bundle, continued upward as a single bundle near the avionics disconnect panel.

Following the SR 111 occurrence, the IFEN installation was examined in 15 Swissair MD-11s. It was noted that the routing of the bundle containing the PSU cables and the 16 AWG control wire varied among aircraft behind the avionics CB panel. None of these variations were considered to affect the immediate safety of flight. There were differences in how frequently this bundle was supported by any of the three horizontally mounted wire support brackets available, and in the methods used for fastening it to the brackets. Also, some installations had protective sleeving installed adjacent to the brackets, while others did not.

Near the avionics disconnect panel, the IFEN wire bundle was routed aft into one of the 102-cm (40-inch) long conduits that were installed above Galley 2 (see Figure 4 and Figure 5). In 11 of the examined Swissair MD-11s, the wire bundle was routed to pass in front of the avionics disconnect panel, and in three of those 11 installations, the bundles were then routed through the outboard conduit. In 4 of the examined aircraft, the bundle was not routed in front of the avionics disconnect panel; instead, it was routed close to the cockpit wall. In 2 of the 4 installations, the bundle was then routed through the outboard conduit. In total, 5 of the aircraft had the IFEN wire bundle routed through the outboard conduit, and 10 had the bundle routed through the middle conduit.

In the occurrence aircraft, it could not be determined from the IFEN installation documentation how the IFEN wire bundle had been routed in the area of the disconnect panel, or which conduit had been used in the area above Galley 2. The IFEN installers preferred to use the middle conduit where possible, but in the five instances noted above, the middle conduit was not available as it had been used for aircraft wiring. In the sequence of IFEN installations, the middle conduit had been used in the three aircraft prior to HB-IWF, and also in the seven aircraft following HB-IWF.

The investigation was not able to establish from the manufacturer's records which conduit might have been left unused in HB-IWF (SN 48448). In the aircraft built immediately before HB-IWF (HB-IWE–SN 48477), the middle conduit was used for the IFEN wire bundle. In the next Swissair aircraft built after HB-IWF (HB-IWG–SN 48452), the outboard conduit was used for the IFEN wire bundle.

The conduit material, based on DMS 2024 Revision B, was Type 1, convoluted, thin wall, fluorinated ethylene-propylene (FEP). The installation of the wire bundle, from where it exited the aft end of the conduit to approximately STA 515, also varied between aircraft. The wire bundle was found to be routed either above or below the upper horizontal angle support bracket for the R1 door ramp deflector, above or below the wire supports, and was clamped to either the top or bottom of these supports or to existing aircraft wiring. Where the IFEN cables were attached to existing wire harnesses, spacers were installed to provide separation between the wire bundles. Additionally, some of the aircraft had protective sleeving installed over the wire bundle in the area near the R1 door ramp deflector upper support.

The wire bundle continued rearward until the PSU 1 and 2 cables were separated from the bundle and terminated at an IFEN electronics rack (E-rack) 1. E-rack 1 was located in first class above the right aisle, with its forward support located at STA 647.

The 16 AWG control wire continued rearward, then crossed over the aircraft crown at approximately STA 750, and was terminated at the relay assembly mounted above Galley 8. This relay assembly received all of the external interfaces to the aircraft system including the following: the decompression signal, which removed power from the IFEN if the aircraft became depressurized; the PA system override signal, which was designed to stop all audio and video on the IFEN system whenever the PA was used; and the 28 V DC power input supplied by the "IFT/VES 28V" 1 A CB. Removal or loss of this 28 V DC power caused an "On/Off" relay, located within the relay assembly, to disable the output of all the PSUs.

The PSU 3 and 4 cables continued rearward until crossing over the aircraft crown at STA 1239. They were then routed rearward along the left side of the fuselage and terminated at E-rack 2. E-rack 2 was located in economy class above the left aisle, with its forward support located at STA 1429.

1.6.11.2.1 Wire description

The primary wire type selected for the IFEN system installation was MIL-W-22759/16, an extruded ethylene-tetrafluoroethylene (ETFE) copolymer insulation, medium weight, tin-coated copper conductor, rated at 150°C, 600 volts. (See Figure 13.) Additionally, the wires used for the main power supply cable were MIL-DTL-16878, an extruded polytetrafluoroethylene (PTFE) insulation, copper-coated copper conductor, rated at 200°C, 1 000 volts. The MIL-W-22759/16 wire had a maximum temperature rating of 150°C.

The 28 V DC wire, from the 1 A CB in the lower avionics CB panel to the IFEN system relay assembly, was specified as 16 AWG MIL-W-22759/16.

Each IFEN PSU power cable consisted of three, 12 AWG, MIL-W-22759/16 wires twisted together. For circuit identification purposes, MIL-C-27500 specification required the wires for each cable to be coloured white, blue, and orange. The cable was to be labelled using identification markers as called out in an HI drawing.

The main IFEN power supply cable consisted of three, 8 AWG, MIL-DTL-16878/5-BNL wires twisted together as called out in an HI drawing. This drawing also stated that the wire will not be identified by printed marking on the outside of the wire. MIL-DTL-16878/5-BNL specifies an extruded PTFE, maximum rating of 200°C, 1 000 volts. For circuit identification purposes, MIL-C-27500 specification required the wires for each cable to be coloured white, blue, and orange. However, a red wire was substituted for the blue wire in the installation, which had no affect on the performance of the wire. Samples of each 8 AWG coloured wire were analyzed by Fourier Transform Infrared Spectroscopy and identified as PTFE with a melting point of 323°C; this was determined by differential scanning calorimetry.

1.6.11.3 Components

E-rack 1 contained the following components (see Figure 14):

• PSUs 1 and 2 that supplied 48 V DC power to CB Unit 1, which distributed 48 V DC power to the components mounted in E-rack 1;
• Two electromagnetic interference (EMI) filter boxes, one attached to each PSU. The filters were connected between the power supply input and the PSU, and were designed to filter out conducted EMI from the aircraft power supply;
• Two 32-channel modulators, which converted the baseband video and audio input signals to broadband RF output signals;
• A video on demand (VOD), which extracted, selected, and distributed the movie/music data;
• A disk array unit, which stored the digitally encoded programming;
• A 13-channel modulator, which performed the same function as the 32-channel modulator, as well as distributed common video/audio information, such as the moving map system, to the entire aircraft;
• Two head-end distribution units, which combined the separate modulator outputs then split the output four ways; and
• Six cluster controllers, which coordinated all the computer network administrative tasks.

The VOD was also equipped with a removable disc pack to permit maintenance personnel to upload movies.

E-rack 2 contained the following:

• PSUs 3 and 4 that supplied 48 V DC power to CB Unit 2, which distributed 48 V DC power to the components mounted in E-rack 2;
• EMI filters 3 and 4; and
• A network switching unit, which provided network links for the IFEN administrative network.

Each first- and business-class seat was equipped with an interactive video seat display that included a touch screen and magnetic card reader; a seat electronics box, which processed all information for the passenger interface; and a dual audio/game-port, which controlled the games and audio. In addition, each set of first- and business-class seats was equipped with a seat disconnect unit, which contained the tuner and network repeater.

A cabin file server, located on a rack in Galley 8, controlled the download of movies, stored flight/casino information, and collected the credit card data transmitted from each seat. Galleys 1 and 8 were fitted with a management video display (MVD). The MVD provided an interface for cabin crew and maintenance personnel, and served as a point of control for configuring, maintaining, and monitoring the IFEN. Each MVD was equipped with a management terminal electronic box, the primary functional component interface to the IFEN by the flight crew and maintenance personnel. A printer was also located in Galley 8.

1.6.12 Aircraft fire protection system

1.6.12.1 General

While no zone of an aircraft is immune to in-flight fires, fire protection systems used in transport category aircraft have evolved based on the probability of fire ignition within particular zones of the aircraft. These aircraft are equipped with a variety of built-in detectors and, in some cases, associated suppression systems designed to assist the aircraft crew in identifying and extinguishing an in-flight fire. In accordance with FAA airworthiness certification requirements, the occurrence aircraft was equipped with built-in fire detection and suppression capabilities in the aircraft's designated fire zones (see Figure 2). FAR 25.1181 states that a designated fire zone includes engines, APUs, and any fuel-burning heater or combustion equipment. In addition, specific regions of the aircraft, such as cargo compartments and lavatories, have been identified as "potential fire zones"^{Footnote 41} that require various built-in detection and suppression capabilities.

The fire risk to the remainder of the pressure vessel was such that it did not have, nor was it required to have, built-in detection and suppression equipment. Therefore, the remaining zones of the aircraft were solely dependent on human intervention for both detection and suppression of an in-flight fire. For the purposes of this report, the remaining zones of the aircraft for which built-in detection and suppression are not specified are referred to as "non-specified fire zones."

1.6.12.2 Portable fire extinguishers

The aircraft was equipped with eight portable fire extinguishers, which were held by brackets mounted in designated locations and distributed throughout the aircraft. In the passenger cabin there were five, 2.5-pound (lb) bromochlorodifluoromethane (Halon 1211) fire extinguishers, and two 5-lb monoammonium phosphate (dry chemical) fire extinguishers. The cockpit contained one 2.5-lb Halon 1211 fire extinguisher held by a bracket mounted on the cockpit rear wall (see Figure 17).

Five of the six Halon 1211 extinguishers, and both dry chemical fire extinguishers, were recovered. It was not possible to determine where these extinguishers had originally been located in the aircraft, primarily because each extinguisher was identical in design, and there were no additional identifying features. Three Halon extinguishers exhibited markings indicating that they were still in their mounting brackets at the time of impact. Two of the three extinguishers still contained a charge of fire extinguishing agent. The pre-impact charge state of the remaining Halon 1211 extinguishers could not be determined, owing to punctures and other damage incurred at the time of impact.

One of the two dry chemical extinguishers showed marks indicating that it was in its mounting bracket at the time of impact. Its charge state at the time of impact could not be determined. The other dry chemical extinguisher was charged at the time of impact, with its locking pin intact; it could not be determined whether this extinguisher was in its mounting bracket at the time of impact.

1.6.12.3 Engine/APU/Cargo and lavatory fire extinguisher bottles

The aircraft was equipped with nine fire extinguishing bottles, containing bromotrifluoromethane (Halon 1301) in the engine, the APU, and cargo areas. Eight of the nine bottles were recovered. Fire handles, which control the activation of the engine fire bottles, were installed on the overhead panel in the cockpit. (See Figure 11.) When the fire handle is pulled and turned, electrically activated explosive cartridges rupture a frangible disc and the extinguishing agent is released from the bottles. The APU bottle is activated automatically when a fire occurs in the APU compartment. The cargo fire bottles are activated by push buttons in the cockpit.

There is no indication that any of these engine/APU/cargo fire extinguishing bottles were discharged by flight crew actions, although some bottles showed signs that they had been discharged by the explosive cartridges, most likely at the time of impact.

A total of four lavatory fire extinguishers were recovered; none could be identified as to its installed location. There was no soot or heat damage on any of the extinguishers. From the recorded information, there was no indication that any of the smoke detectors in the lavatories activated.

See the supporting technical information on this topic.

1.6.13 Flight control system

1.6.13.1 General

The MD-11 has a conventional flight control column and rudder pedal configuration for the captain and first officer. The primary flight control system comprises the inboard and outboard elevators, the inboard and outboard ailerons, and one upper and one lower rudder. The secondary flight control system comprises the inboard and outboard wing flaps and slats, the wing spoilers/speed brakes, and a controllable horizontal stabilizer.

All primary and secondary flight control surfaces are hydraulically powered by two aircraft hydraulic systems. Flight control positions are displayed, normally by DU 4, on the SD by selecting the configuration page with the CONFIG cue switch on the SDCP. In addition to the SD, flap and slat positions are also shown on the PFD. Alerts will appear on the EAD and the SD.

Other than the slats, which are electrically controlled and hydraulically actuated, the flight control system is designed with a direct mechanical/hydraulic interface consisting of cables that run between the cockpit controls and the various hydraulic actuators that move the control surfaces. Therefore, with the exception of the slats, the movement of the control surfaces does not depend on the availability of electric power.

See the supporting technical information on this topic.

1.6.13.2 Longitudinal stability augmentation system

The MD-11 incorporates a longitudinal stability augmentation system (LSAS) that enhances longitudinal stability through commands to the elevators in a series mode. The LSAS holds the existing pitch attitude of the aircraft whenever the sum of the captain's and first officer's column forces is less than two pounds. In the software version that was installed in the occurrence aircraft, below 15 000 feet, there is no LSAS input when the column force is above two pounds. Above 15 000 feet, the LSAS provides an additional pitch rate damping input when the control column force is above two pounds. Automatic pitch trim of the horizontal stabilizer is also operative in the LSAS mode.

The LSAS is inoperative whenever the autopilot is engaged or when the aircraft is below 100 feet above ground level (agl). With the LSAS inoperative and automatic pitch trim unavailable, manual pitch trim is available.

As part of the investigation, simulator flights were conducted below 15 000 feet to gain an appreciation of the flyability of the MD-11 with the LSAS inoperative. There were no noticeable controllability changes in the pitch control or flyability of the aircraft with the LSAS inoperative.

1.6.13.3 Flaps and slats

The flaps and slats are controlled by the FLAP/SLAT lever on the right-hand side of the cockpit centre pedestal. In normal operation, as part of the climb-out check, the pilots would pre-select 15 degrees of flap on the DIAL-A-FLAP wheel located on the right-hand side of the FLAP/SLAT lever. When the flaps are selected down they extend to the pre-selected setting (in the case of SR 111, 15 degrees); the slats normally extend whenever the flaps are extended.

At the time of impact, the flaps were extended to about 15 degrees, and the slats were retracted. The slat system incorporates overspeed protection, which prevents the slats from extending whenever the aircraft's speed is above 280 knots and the flaps are extended less than 10 degrees. The slat overspeed protection can also be overridden by selecting a flap extension of 10 degrees or more. The slat-extend function can also be overridden by pushing a SLAT STOW button, which is used in the event of either a slat disagree alert or the loss of hydraulic systems 1 and 3. There is no indication that either of these events occurred on the accident flight. The failure of the slats to extend was most likely the result of fire damage that led to an interruption in the electrical power supply to the slat control valves.

1.6.14 Fuel system

1.6.14.1 General

The fuel is stored in three main tanks and two centre auxiliary tanks (upper and lower). The three main fuel tanks are located in the wings. Tank 1 (in the left wing) and Tank 3 (in the right wing) are identical, each having a main compartment, and an outboard compartment called the tip tank. Tank 2 is located in the inboard portion of each wing, and the two halves are interconnected by a large diameter fuel line to tanks 1 and 3. The two centre auxiliary tanks are located in the interspar fuselage section and are interconnected to the main tanks via a fuel manifold. The engines normally receive fuel, under pressure, from their respective main tank; the APU receives fuel from Tank 2. Because engines 1 and 3 are located below the wings, they can draw fuel from the fuel tanks even if the electric fuel pumps become inoperative. Engine 2, being tail-mounted and higher than the main fuel tanks, needs fuel to be pumped to the engine to maintain normal engine operation. In the event of a total electrical failure, fuel pressure to Engine 2 can be maintained by the Tank 2 left aft fuel pump and the tail tank alternate pump, both of which are powered by the right emergency AC bus following deployment of the ADG. The MD-11 is also equipped with a tail fuel tank, located in the horizontal stabilizer. During flight, fuel is automatically transferred in and out of this tank as required to maintain an aircraft C of G that aerodynamically provides the most economical fuel consumption. Every 30 minutes while the tail tank temperature is above 2°C, fuel is automatically transferred from the tail tank to Tank 2 or the upper auxiliary tank. On this particular flight, Tank 2 would have been the tank receiving the tail fuel.

There are seventeen, 115 V AC motor-driven boost or transfer fuel pumps interspersed among the various tanks. All of these pumps are electrically powered by one of the three generator buses; the Tank 2 left aft and the tail alternate pumps are powered from the right emergency AC bus, which receives power from the ADG if normal generator power is lost. All the pumps are automatically controlled throughout the flight by the fuel system controller (FSC) depending on the required fuel schedule, which includes fuel load, fuel distribution, phase of flight, fuel dumping, water purging, weight and balance control, and engine cross-feed operation requirements. The FSC checks and maintains the fuel schedule to satisfy structural load requirements and transfers fuel to the appropriate tanks to ensure proper distribution. The pumps can also be operated in MANUAL mode or, in certain failure conditions, the FSC may automatically revert to MANUAL mode. In the MANUAL mode, a selected set of fuel pumps will automatically turn on and can be controlled individually by a push button selection on the fuel SCP.

Three cross-feed valves can be used in the event of a fuel system delivery malfunction. In the event of an engine feed pump failure, the associated cross-feed valve can be opened to direct fuel to that engine. In the event of a main transfer-pump failure, fuel can be transferred using the engine feed boost pumps by opening the associated cross-feed valve.

The auxiliary tank fill/isolation valve works in conjunction with the tail tank fill/isolation valve when fuel is automatically transferred in and out of the tail tank for C of G control. Both valves are open when fuel is being transferred into the tail tank. When fuel is being transferred out of the tail tank, the tail tank fill/isolation valve is closed. Depending on flight conditions and the quantity of fuel in the upper auxiliary tank, the auxiliary tank fill/isolation valve is either open or closed. An open valve directs fuel to the three main tanks; a closed valve directs fuel to the upper auxiliary tank.

See the supporting technical information on this topic.

1.6.14.2 Fuel status at departure

After refuelling at JFK airport, the occurrence aircraft had a fuel load of 65 300 kg of Jet A fuel. The flight plan indicated that SR 111 would use 1 000 kg for taxi, leaving a fuel load at take-off of 64 300 kg.

1.6.14.3 MD-11 fuel dumping system

The MD-11 has two fuel dump valves for dumping fuel overboard. There is one dump valve on the trailing edge of each wing, between the outboard aileron and outboard flap. Fuel dumping is initiated by selecting the DUMP switch on the fuel SCP in the cockpit. Selecting the DUMP switch activates the boost pumps, transfer pumps, and the cross-feed valves. The fuel dump rate is approximately 2 600 kg per minute, provided that all of the fuel pumps and both of the dump valves are functioning normally.

Fuel dumping will cease when the DUMP switch is selected again, when the aircraft gross weight reaches a weight that was pre-selected by the pilots through the FMS, or at any time the FUEL DUMP EMERGENCY STOP button is pushed. The FMS fuel dump default is set to the maximum landing weight of the aircraft: 199 580 kg. If a pre-selected weight is not set by the crew, fuel will be dumped until the aircraft weight reaches the default weight. Pilots do not normally pre-select a weight; they use the default setting as the desired dump weight. As a backup, each main fuel tank has low-level float switches that will stop fuel dumping from that tank when the fuel load in the tank reaches 5 200 kg.

See the supporting technical information on this topic.

Fuel dumping flow rates will be reduced if the SMOKE ELEC/AIR selector is selected while dumping is taking place. Fuel dumping had not started prior to stoppage of the FDR recording, and fuel dumping was not underway at the time of impact. If the SMOKE ELEC/AIR selector was selected during the last few minutes of the flight, any associated reduction in fuel dumping rate would not have been a factor in this occurrence.

See the supporting technical information on this topic.

1.6.15 Hydraulic system

Hydraulic power for the MD-11 is derived from three parallel, continuously pressurized systems. Each system is powered by two engine-driven hydraulic pumps. Different combinations of two of the three systems provide parallel power to each of the primary flight control actuators. Two back-up electrically driven hydraulic pumps are also available. If necessary, one of these pumps can be driven by electrical power from the ADG.

In the event of an in-flight engine shutdown, if the aircraft is in a take-off or land configuration (the flaps, slats, or landing gear are extended), hydraulic power is transferred automatically from an operating system to a non-operating system by reversible-motor pumps. In the cruise configuration, hydraulic power is not transferred.

During the investigation, various components of the hydraulic system were examined to determine whether any anomalies in the hydraulic system could have had an adverse effect on aircraft controllability. The shut-off valves associated with the reversible-motor pumps were found to have been closed at the time of impact when it would be expected that, given the configuration of the aircraft, at least one set of valves would have been open, allowing one of the reversible-motor pumps to operate. 

Engine 2 was shut down by the pilots approximately one minute prior to the time of impact (see Section 1.12.9). The shutdown of Engine 2 and the loss of automatic hydraulic power transfer through a reversible-motor pump would have resulted in an eventual loss of, or reduction in, Hydraulic System 2 operating pressure. However, the functions of the primary flight controls operated by Hydraulic System 2 would have been picked up through a parallel operating system. Therefore, the anomaly would have had little or no adverse effect on aircraft controllability.

See the supporting technical information on this topic.

1.6.16 Cockpit windows

The aircraft has six windows in the cockpit, three on each side. The two front windows are referred to as the left and right windshields. The windows immediately aft of the windshields are referred to as the left and right clearview windows; these can be manually opened under certain conditions. The two windows behind the clearview windows are referred to as the left and right aft windows.

All of the windows have imbedded electrical heating elements that are designed to prevent fogging on the inside of the window. The two windshields have additional electrical heating elements to prevent ice from forming on the outside. All of the windows have temperature sensors that allow the heating elements to be controlled from the windshield anti-ice panel located in the overhead control panel.

The controllers and sensors maintain the correct temperatures for anti-icing and defogging. The controllers automatically provide a gradual increase in heating to avoid thermal shock, and will remove electric power if an overheat condition occurs. An alert will be displayed on the EAD if any part of the system is not operative or if overheating occurs.

1.6.17 Landing gear

The MD-11 has four landing gear assemblies: two main gear, a centre gear, and a nose gear. The two main landing gear retract inward; the centre main landing gear and the nose landing gear retract forward. The landing gear is hydraulically operated. Normal gear extension and retraction is provided by Hydraulic System 3.

All four landing gear assemblies were in the retracted position at the time of impact. The right main landing gear displayed greater overall damage than did the left main landing gear.

See the supporting technical information on this topic.

1.6.18 Aircraft interior lighting

1.6.18.1 Cockpit and passenger cabin normal lighting

The MD-11 cockpit lighting includes overhead fluorescent lamps for area lighting, flood lights to illuminate the instrument panels, and integrally lighted panels. The cockpit also has supplemental lighting that includes flight crew reading lights (map lights), floor lights, and briefcase lights. The intensity of most of the lights can be controlled by rotary dimmer switches.

Lighting in the cabin includes overhead and side wall fluorescent light assemblies, as well as incandescent light assemblies that provide overhead aisle lighting and door entry lights. Cabin lights can be controlled from the cabin attendant stations.

1.6.18.2 Emergency lighting, battery packs, and battery charging system

The MD-11 has an emergency lighting system that illuminates the cockpit and the cabin. The system includes ceiling lights in the cockpit, as well as overhead aisle lights, cabin door handle lights, exit sign lighting, and floor escape path lighting in the cabin.

The emergency lighting system consists of the lighting network and six battery packs, each with a battery charger and control logic that determines the power source. The system, including battery charging, is normally powered by the right emergency AC bus. If normal power is disrupted, the control logic is designed to switch first to the left emergency DC bus, and then if necessary, to the battery packs.

The batteries are on continuous charge whenever the EMER LT switch located in the cockpit is in the ARMED position and the EMER LT switch located at the left mid-cabin attendant station is in the OFF position. This is the normal in-flight switch configuration. Fully charged batteries will allow for about 15 minutes of emergency lighting.

The emergency lights can be turned on by using either the EMER LT switch in the cockpit, or the switch at the attendant station. The lights turn on automatically with a loss of power to the 115 V AC ground service bus.

The first item in the Swissair Smoke/Fumes of Unknown Origin Checklist (see Appendix C) calls for selecting the CABIN BUS switch to the OFF position. Doing so removes the electrical power from the cabin bus that supplies power to most of the cabin electrical services. If the EMER LT switch on the cockpit overhead panel is not switched to the ON position before moving the CABIN BUS switch to OFF, the cabin emergency lights will not automatically illuminate. In such a case, either the pilots or a cabin attendant would need to turn the EMER LT switch on to activate the emergency lights.

1.6.18.3 Flight crew reading light (Map light)

The MD-11 cockpit has four map lights installed in the overhead ceiling area (see Figure 16). These lights provide additional illumination for the pilot and first officer positions, and for the left and right observers' stations. On the occurrence aircraft, the captain, first officer and right observer's station lights (PN 2LA005916-00) were manufactured by Hella KG Hueck & Co. (Hella). The left observer's light, PN 10-0113-3, was manufactured by Grimes Aerospace Co., and was a different design than the Hella light.

See the supporting technical information on this topic.

The Hella map light is designed to pivot up to 35 degrees from its vertical axis through 360 degrees. The light intensity is adjusted by turning the smaller diameter ring on the light head, which also serves as an ON/OFF switch. The size of the light beam, or area of illumination, is adjusted by turning the larger diameter ring on the light head. The map light was equipped with a 11.5 watt (W), 28 V DC tungsten halogen lamp.

The front of the map light is covered by a plastic ball cup; an insulating protective cap is installed on the rear of the light fixture. The protective cap is designed to insulate and protect the metal contact spring, which serves as the positive terminal that applies 28 V DC electrical power to the lamp base.

The Swissair MD-11 flight crew bunk module lights, PN 2LA 005 916-00 SWRA, were also manufactured by Hella. This bunk light was a map light that had been modified by removing the functionality of the ON/OFF switch to meet an FAA certification requirement. Although the bunk light used a different outer housing than the map light, the internal components were identical.

1.6.19 Emergency equipment

1.6.19.1 Cockpit emergency equipment

The Swissair configuration of the MD-11 cockpit has four seats, with an oxygen mask dedicated to each seat position (see Figure 17). A rechargeable flashlight for each pilot is readily available from the seated position. Additional emergency equipment is stored on the cockpit rear wall behind the captain's seat; to retrieve this equipment, pilots have to leave their seats. The additional equipment includes a Halon 1211 fire extinguisher, fire gloves, two sets of portable protective breathing equipment (PBE), two additional flashlights, a crash axe, four life vests, and an emergency VHF radio transceiver. The emergency transceiver, which is normally stowed in the OFF position, is self-contained, battery operated, and pre-set to the international emergency frequency 121.5 MHz.

1.6.19.2 Cabin emergency equipment

The following emergency equipment is located in the cabin: seven fire extinguishers (five Halon 1211 and two dry chemical extinguishers) and fire glove sets, eight 310 litre (L) and two 120 L portable first-aid oxygen bottles with masks, one crash axe, 14 flashlights, 11 sets of PBE, life vests for each passenger and flight attendant, medical kits, a megaphone, along with other miscellaneous items. In the skybunk flight crew rest areas there are two additional 120 L first-aid oxygen bottles, and two flashlights. In the cabin crew rest area there are an additional four 310 L oxygen bottles, one PBE, one Halon 1211 extinguisher, gloves, and a flashlight. (See also Section 1.6.12.2.)

1.6.19.3 Flight Crew Oxygen

The Swissair MD-11 flight crew oxygen is supplied from one aluminum, high-pressure oxygen cylinder wrapped with a para-aramid fibre. The system delivers regulated oxygen through stainless steel lines to mask-mounted regulators, and supplies the captain, first officer, and the two observers' positions. A "T" fitting is installed in the stainless steel supply line near the crown of the aircraft, between STA 383 and STA 374, to provide an option for an additional crew mask in the freighter configuration. The "T" fitting is capped with an AN929-6 aluminum cap that, when installed, protrudes through the between-frame insulation blankets into the cockpit attic area (see Figure 5).

Each full-face mask assembly is stowed in a quick-access stowage box at each flight crew station, with the oxygen supply lines and microphone connections at the base of each stowage box (see Figure 11). When the oxygen mask stowage box door is opened, the mask microphone is automatically activated and the boom microphone deactivated.

The crew oxygen masks have a six-foot attachment line. Therefore, with the mask on, the captain can reach all of the emergency equipment, the cockpit door, and the overhead CB panels. The first officer would not be able to reach any of the emergency equipment, but can reach the cockpit door and the overhead CB panels. If conditions permitted, an option for the first officer would be to don an observer's oxygen mask; the hose length of either of these two oxygen masks would allow sufficient range of movement to reach the PBE and flashlights. The two portable PBEs each have a 15-minute supply of oxygen.

Each flight crew oxygen mask is fitted with a pneumatic harness, which is inflated by pressurized oxygen by manually actuating a lever on the regulator. When inflated, the harness allows easy donning and doffing of the mask, and fits easily over glasses and headsets. The harness deflates on release of the lever, tightening the mask to the wearer's face. The mask is equipped with a vent valve to purge any smoke from the goggles.

The mask-mounted regulators can function in one of three positions: normal diluter demand, 100 per cent oxygen, or emergency pressure breathing. The default position is normal diluter demand; 100 per cent oxygen or emergency pressure must be selected by the pilots. Such a selection would be made as warranted by the circumstances.

The SR 111 pilots were using oxygen for about 15 minutes. The charge state of the bottle at take-off was not determined; however, with both pilots using 100 per cent oxygen, the duration of the supply with a minimum dispatch pressure of 1 000 pounds per square inch (psi) would be at least 64 minutes. At 1 850 psi, which is a fully charged bottle, the duration would be about 119 minutes.

The crew oxygen cylinder pressure was last checked and the cylinder was refilled, on 9 August 1998, during an "A check." The cylinder was last hydrostatically tested on 17 March 1997. An examination of the crew oxygen cylinder showed that it was pressurized at the time of impact. During the time the CVR was recording, the pilots did not indicate having any problems with the oxygen system.

1.6.19.4 Passenger oxygen

The MD-11 is fitted with independently mounted oxygen generators throughout the passenger and cabin crew areas. These generators supply oxygen masks that drop from compartments in the overhead panels. The masks are designed to be fitted over the nose and mouth. Once activated, each generator is capable of supplying a flow of oxygen to the masks that it serves for a minimum of 15 minutes.

The passenger cabin masks are stored behind module doors above the seats. The doors are held closed by electrically operated latches. The latches are powered by the 115 V AC buses 1, 2, and 3. If the cabin pressure decreases below a value equivalent to the standard pressure at 14 400 feet, the latches release and the doors fall open, allowing the masks to drop. The doors can also be selected open by the pilots through a switch in the cockpit.

The occurrence aircraft was equipped with 148 oxygen generators.

The Swissair MD-11 Aircraft Operations Manual (AOM) warns that passenger oxygen masks must not be released below a cabin altitude of 14 000 feet when smoke or an abnormal heat source is present, as the oxygen may increase the possibility or severity of a cabin fire. As is typical with passenger oxygen masks in general use in transport category aircraft, the passenger masks in the MD-11 were designed to provide a mix of oxygen and ambient air. Therefore, the use of the masks would not have prevented passengers from inhaling smoke if it were present.

See the supporting technical information on this topic.

1.6.20 Powerplants

1.6.20.1 General

The occurrence MD-11 aircraft was equipped with three Pratt & Whitney model 4462 engines. The engines are referred to by number: Engine 1 mounted under the left wing, Engine 2 mounted in the vertical stabilizer (tail), and Engine 3 under the right wing.

The aircraft is also equipped with an APU mounted in the tail section. The APU on the occurrence aircraft was not used by the pilots before the stoppage of the FDR, and it was not operating at the time of impact.

1.6.20.2 Full-authority digital electronic controls

The engine thrust for each engine is controlled by a dual-channel (channels A and B) FADEC that interfaces with the aircraft and engine control systems. Each channel is independently capable of controlling engine operation. Electrical power to each FADEC is supplied primarily by an engine-driven permanent magnet alternator. Each FADEC can also be powered, if necessary, by the aircraft electrical system, through a supplemental control unit (SCU); this was an optional feature installed on this aircraft. This method of powering the FADEC using the SCU is referred to as back-up power. The FADEC also receives inputs from the engine throttle resolvers located below the central pedestal and linked to the throttle levers. There are two throttle resolvers per throttle lever. One resolver provides throttle resolver angle (TRA) input to Channel A and the second to Channel B. Electrical excitation for the resolvers is provided by the FADEC.

Each FADEC channel (A and B) also receives information from three digital data buses. Two of the buses supply data from the ADCs and the other supplies data from the FCCs. FCC-1 provides data to Channel A and FCC-2 provides data to Channel B. The ADCs provide pressure altitude, fan inlet total pressure (Pt2)^{Footnote 42} and total air temperature (Tt2)^{Footnote 43} to channels A and B. The FCCs provide EPR trim, engine bleeds, Weight-On-Wheel (nose gear compressed), and "flaps/slats retracted" information.

Each FADEC channel includes non-volatile memory (NVM) that records fault information used for maintenance scheduling and troubleshooting. There are 192 continuously available NVM fault cells. Each fault is registered only one time per flight leg, but is rewritten to memory when the engine is shut down with the engine FUEL switch. The contents of the fault memory will typically span many flights. The information in these memory cells is retained until all 192 NVM cells have been filled with information, at which time the information begins to be overwritten from the beginning.

Certain faults will cause the engine to revert from the normal EPR mode to the soft reversionary N₁ mode of operation. This reversion will also cause the autothrottles to disconnect. Autothrottle cannot be re-engaged if any engine is in the N₁ mode. Loss of TRA input will cause the engine to go to a fixed thrust that cannot be altered through the throttle control levers.

See the supporting technical information on this topic.

1.6.21 Landing performance

Landing distances at various aircraft weights were calculated to determine whether the occurrence aircraft could have stopped safely on Runway 06 at the Halifax International Airport. Calculations were completed for the occurrence aircraft with all systems operating normally, and with certain technical malfunctions.

The horizontal distance necessary to land an aircraft and come to a stop on a level, smooth, dry, hard-surfaced runway is called the landing distance. This distance is based on the aircraft being in the landing configuration on a stabilized landing approach at a height of 50 feet (15 m) above the landing surface (usually the runway threshold). For normal operations at destination and alternate airports, regulations require that this full stop landing be accomplished within 60 per cent of the available runway length,^{Footnote 44} with spoilers, and anti-skid operative, but without use of thrust reversers.

The Swissair MD-11 AOM contains landing graphs that flight crew can use to calculate anticipated landing distances. These graphs provide landing information for 35-degree and 50-degree flap settings, predicated on aircraft landing weight, airport elevation, wind component, and runway surface conditions. For unscheduled landings, the regulations do not require any operational reserve or safety margin as would be included when calculating the runway length for normal operations (1.67 multiplied by the landing distance).

The atmospheric conditions that existed at the time of the occurrence for a landing on Runway 06 at the Halifax International Airport were taken into account. For situations where all aircraft systems are operating normally, the calculated landing distances for various weights are shown in Table 10.

Table 10. Calculated landing distance–All systems operating normally

Aircraft Weight	Flaps 35 Degrees Landing	Flaps 50 Degrees Landing
199 580 kg	4 725 ft.	4 236 ft.
218 400 kg	5 118 ft.	4 725 ft.
230 000 kg	5 316 ft.	4 920 ft.

If certain technical malfunctions occur, additional horizontal stopping distance will be used by the aircraft; therefore, a correction factor would need to be applied to estimate these increased landing distances. The Swissair AOM lists correction factors that must be added to the landing distance for various possible malfunctions. As indicated in Section 1.6.13.3, the wreckage revealed that the slats were retracted; if the pilots were aware of this anomaly, they would be required to land the aircraft with 28 degrees of flap, which is the certified landing configuration with slats retracted. Also, fire damage to the upper avionics CB panel resulted in several systems failures being recorded before the flight recorders stopped. The ground sensing CB is located in the area adjacent to the systems that were recorded as faults. If the ground sensing circuit was compromised because of the fire, the aircraft, once on the runway, would not have auto ground spoilers or the brake anti-skid feature. These additional factors would need to be added to the calculated landing distance. The minimum landing distance the SR 111 aircraft would have required under conditions of no slats, inoperative spoilers, and anti-skid brakes is shown in Table 11.

If the flight crew were unable to select 28 degrees of flap and landed with 15 degrees of flap, the landing distances would increase by approximately 12 per cent, as shown in Table 11. If the flight crew were able to get the flaps to 50 degrees and decided to conduct a landing in this unconventional configuration, then the above landing distances would be reduced by approximately 10 per cent.

Table 11. Estimated landing distance–With technical malfunctions^{Footnote 45}

Aircraft weight	Flaps 15 Degrees, Slats Retracted, Anti-skid System Inoperative, Auto Ground Spoilers Not Available	Flaps 28 Degrees, Slats Retracted, Anti-skid System Inoperative, Auto Ground Spoilers Not Available	Flaps 50 Degrees, Slats Retracted, Anti-skid System Inoperative, Auto Ground Spoilers Not Available
199 580 kg	10 700 ft.	9 600 ft.	8 700 ft.
218 400 kg	11 800 ft.	10 600 ft.	9 500 ft.
230 000 kg	12 400 ft.	11 100 ft.	10 000 ft.

A caution in the AOM landing graphs states that for every 5 knots above the ideal approach speed, the landing distance will increase by 1 000 feet. The SR 111 flight crew was dealing with smoke and fire in the cockpit and failed aircraft systems and displays, and at some point was flying on standby instruments. Therefore, it is likely that the aircraft would not have been at the ideal position and speed for landing over the threshold, which could further increase the landing stopping distance. Thrust reversers, if available, would reduce this distance slightly.

Considering all of the factors, the SR 111 landing would likely have required more runway than the 8 800 feet available on Runway 06 at the Halifax International Airport.

1.6.22 Aircraft maintenance records and inspection

1.6.22.1 General

The Maintenance System Approval Statement contained in Swissair's Air Operator Certificate (AOC) 1017 stated that Swissair was approved under Joint Aviation Requirements (JAR)-OPS 1, Subpart M, to manage the maintenance of its MD-11 aircraft. At the time of the occurrence, Swissair had contracted all aircraft maintenance to SR Technics, and Swissair had no in-house maintenance capability. As a JAR/FAR 145-approved repair station, SR Technics was contracted to perform all aircraft maintenance defect rectification, maintenance checks beyond the pre-flight, maintenance engineering activities, maintenance planning, and spare parts handling in support of Swissair's operations.

See the supporting technical information on this topic.

1.6.22.2 Maintenance records

During the investigation, a review was conducted of Swissair/SR Technics' maintenance program, record-keeping procedures, and the occurrence aircraft's maintenance records. A small number of discrepancies were discovered regarding engineering orders (EO) and logbook entries. The discrepancies were considered minor, and the overall method of record-keeping was considered to be sound. The maintenance records kept for HB-IWF indicate that it was maintained in a manner commensurate with industry practices.

The review of the aircraft's maintenance records, which included the technical logbook entries from 10 September 1997 until 2 September 1998, the last three "A checks," and the IFEN System Maintenance Activity Review, did not identify any events that were considered relevant to the investigation.

1.6.22.3 Maintenance inspections

In addition to the maintenance checks carried out before every departure, Swissair MD-11s underwent a series of scheduled maintenance activities. These were accomplished at various flight hours (FH) as follows: "A check" every 700 FH; "C check" every 6 000 FH; and first "D check" at 30 000 FH or 72 months, whichever occurred first. The last scheduled maintenance activity carried out on the occurrence aircraft was an "A check" completed on 10 August 1998.

A review of HB-IWF's maintenance history verified that all requirements of the approved maintenance program were completed either on time, or within the tolerance granted to Swissair by the Swiss Federal Office for Civil Aviation (FOCA).

1.6.22.4 MD-11 Service information

1.6.22.4.1 Service bulletins

Aircraft manufacturers and product vendors issue to users of their products, documents that are designed to improve the level of flight safety, to provide specific advice or instructions, or both. These documents include, but are not limited to, Service Bulletins (SB), Alert Service Bulletins (ASB), Service Letters, and All Operator Letters (AOL). The type of document issued depends upon the issuer's assessment of the urgency or severity of the information being presented; ASBs have the highest priority. Compliance with these documents is at the owner's or operator's discretion, as compliance is not mandatory unless an associated Airworthiness Directive (AD) is promulgated by the applicable regulatory authority.

At the time of the occurrence, there were 822 MD-11 SBs applicable by fuselage number to HB-IWF of which 51 were ASBs. Of the 51 ASBs, 47 were complied with, 2 were related to AD 94-10-03 for which an exemption was granted (see Section 1.6.22.4.2), 1 was underway, and 1 was specific to a water heater installation that was not installed in the Swissair fleet of MD-11s. The SR Technics engineering department reviewed each SB. If it determined that the SB warranted incorporation, they produced an EO. The determination to accept or reject an applicable SB was made by the cognizant engineer, and reviewed and approved by the cognizant engineer's manager.

A review of the aircraft manufacturer's MD-11 SBs issued up to the time of the accident identified 16 that were considered of interest to the investigation. Included in these were SBs related to events that could cause chafing, arcing, sparking, or smoke in the cabin or cockpit.

1.6.22.4.2  Airworthiness directives

An AD, typically based on either a manufacturer's or vendor's SB, is issued when an unsafe condition exists and that condition is likely to exist or develop in other products of the same type design. An AD is a regulatory directive mandating an inspection, repair, modification, or procedure issued either by the state of manufacture or by the CAA of the country in which the aircraft is registered.

The FOCA adopts and reissues each AD published by a state of manufacture pertaining to aircraft registered in Switzerland or with products that might be installed on Swiss-registered aircraft. Within SR Technics, the FOCA AD will only be distributed if it is not covered by an AD issued by the state of manufacture, or if there are deviations in the content. Swissair complied with all ADs issued by the state of manufacture, even if they were not legally binding for Swiss-registered aircraft under Swiss legislation.

At the time of the occurrence, 57 MD-11 ADs were issued by the FAA that were applicable to the occurrence aircraft. The SR Technics "Status List of Engineering Orders" verified that all applicable ADs had been accomplished, with the exception of AD 94-10-03, for which an exemption has been granted to Swissair by the FOCA. AD 94-10-03 addressed a potential software anomaly involving navigation equipment input to the FMC/FCC, and was therefore not deemed to be relevant to the circumstances of this occurrence. A review of the MD-11 ADs issued by the FAA up to the time of the accident identified the following two ADs that were potentially related to either the area of the fire damage in SR 111 (AD 93-04-01) or other smoke events in the cockpit (AD 97-10-12).

The subject of AD 93-04-01 was to "prevent display units from going blank, which could lead to momentary loss of flight critical display information." This AD took effect on 2 April 1993 and referred to ASB MD-11 A24-51, which took effect on 11 September 1992. SR Technics accomplished the AD on 14 January 1993 when the ASB was completed.

The subject of AD 97-10-12 was to "detect and correct chafing of the wire bundles adjacent to the avionics disconnect panel bracket assembly and consequent in-flight arcing behind the avionics CB panel, which could result in a fire in the wire bundles and smoke in the cockpit." This AD took effect on 16 June 1997 and referred to SB MD11-24-111, which took effect on 3 December 1996. SR Technics had accomplished this AD on HB-IWF on 6 March 1997.

1.6.22.5 MD-11 Service difficulty reports

A search of the FAA's Service Difficulty Report (SDR) database for MD-11/11F entries, submitted until September 1998, revealed a total of 970 SDRs.^{Footnote 46} At that time, the MD-11/11F SDRs were reviewed using the keywords fire, smoke, and smell. Additionally, the same data was searched using the Air Transport Association (ATA) codes for communications (2300) system, power distribution (2400), and fire protection (2600) systems. This review revealed some general statistical information referred to in Section 1.18.10, but did not identify specific discrepancies relevant to the circumstances of this investigation. Detailed and specific information regarding wiring discrepancies was not consistently available as it was not required to be captured within the SDR database. There was no dedicated Joint Aircraft Systems/Components Inspection Code (enhanced ATA codes) used to collect, compile, and monitor data regarding wiring discrepancies. However, during the course of this investigation, on the basis of wiring data issues highlighted by National Transportation Safety Board (NTSB) investigations such as Trans World Airlines 800^{Footnote 47} and by industry group deliberations, the FAA requested that the ATA introduce a new ATA reporting code subchapter (97) to facilitate more accurate tracking of specific wire-related problems and anomalies.

See the supporting technical information on this topic.

1.6.22.6 MD-11 Maintenance management

As with any commercial aircraft, the maintenance management of the MD-11 involved various companies and regulatory agencies. Beyond Swissair's maintenance obligations, as outlined in their AOC, SR Technics, the FOCA, the FAA, and Boeing all had either direct or indirect maintenance management commitments in support of Swissair's MD-11 fleet (see Section 1.17).

1.7 Meteorological information

1.7.1 General

Two active weather systems were in the area of the SR 111 flight track between New York to Halifax: a line of thunderstorms moving through the New York area; and Hurricane Danielle, which was located approximately 300 nm southeast of Halifax. The forecasted effects of both systems were moving in a predictable manner. Nova Scotia was under the influence of a weak ridge of high pressure and the distant effects of the hurricane.

1.7.2 Forecast weather

The aviation area forecast weather for the region including Peggy's Cove was as follows: 2 000 to 3 000 feet scattered, occasional broken cloud with the tops at 8 000 feet; 10 000 feet broken occasional overcast with the tops at 16 000 feet, high broken cloud, visibility greater than 6 statute miles (sm).

The terminal aerodrome forecast (TAF) for Halifax Shearwater Airport, located between the Halifax International Airport and the crash site near Peggy's Cove, was as follows: surface wind 070 degrees True at 10 gusting to 20 knots; visibility greater than 6 sm; a few clouds at 500 feet agl; scattered clouds at 2 000 feet agl, broken clouds at 24 000 feet agl; temporarily from 2300 to 0200, 5 sm in light rain showers and mist; scattered clouds at 500 feet agl, broken clouds at 2 000 feet agl, and overcast at 10 000 feet agl.

The TAF for Halifax International Airport was as follows: surface wind 090 degrees True at 10 knots; visibility greater than 6 sm; scattered cloud layers at 3 000 feet agl, broken cloud at 8 000 feet agl, and broken cloud at 25 000 feet agl.

1.7.3 Actual reported weather

The actual weather at JFK airport just prior to the departure of SR 111, was as follows: surface winds 170 degrees True at 12 knots; visibility 10 sm in thunderstorms and light rain; broken cloud at 2 200 feet agl, broken cloud at 4 000 feet agl consisting of cumulonimbus clouds, overcast layer at 9 000 feet agl; temperature 23°C; dew point 21°C; altimeter setting 29.73 inches of mercury (in. Hg). Remarks: thunderstorms in vicinity, west to northwest of the airport, moving eastward; thunderstorm began at 0010, rain began at 0003.

The weather at the Halifax Shearwater Airport at 0100 was as follows: surface winds 060 degrees True at 9 knots; visibility 15 sm; few clouds at 1 200 feet agl, broken clouds at 7 000 feet agl, overcast at 25 000 feet agl; temperature 18°C; dew point 15°C; altimeter setting 29.78 in. Hg; and cloud cover: stratus fractus 1/8, altocumulus 5/8, cirrus 3/8.

The weather at Halifax International Airport at 0100 was as follows: surface winds 100 degrees True at 10 knots; visibility 15 sm; broken cloud at 13 000 feet agl, overcast at 24 000 feet agl; temperature 17°C; dew point 13°C; and altimeter setting 29.80 in. Hg; and cloud cover: altocumulus 6/8, cirrostratus 2/8.

Between 0100 and 0200, the sky in the Peggy's Cove area was partially covered by clouds, and there were rain showers in the area. Visibility was recorded as "good" at weather stations on land; however, it was somewhat reduced in mist over the sea. The winds were blowing at about 10 knots. The air temperature was about 16°C.

1.7.4 Upper level wind

The wind at FL330 was from 210 degrees True at 65 knots, providing a ground speed for SR 111 of about 530 knots or nearly 9 nm per minute. The tailwind decreased during the descent, and diminished to about 13 knots from 200 degrees True at 10 000 feet.

1.7.5 Weather briefing

Swissair flight operations officers in New York briefed the pilots and the flight planning was routine, the only exception being the selection of a more northerly track than normal. This route was chosen to avoid any adverse weather being generated by Hurricane Danielle. The weather briefing package received by the crew included, in part, forecasts for Boston, Bangor, and Halifax.

1.7.6 Weather conditions on departure from JFK

At the time SR 111 departed from JFK airport, there was lightning associated with cumulonimbus clouds in the area, northwest and south of the airport. Within two minutes after take-off, the flight crew requested a heading deviation from the cleared track routing to avoid the isolated thunderstorms in that area. Cloud-to-ground lightning strike data indicated that the aircraft was more than 23 nm away from the closest ground strike and much farther away from the major ground lightning activity. Therefore, it is unlikely that the aircraft sustained a direct lightning strike from the cloud-to-ground lightning.

The weather report at JFK airport included occasional lightning in cloud at the time of SR 111's departure, with isolated thunderstorms and cumulonimbus clouds in the vicinity. There was no reported lightning from cloud-to-cloud, only within the cloud. The thunderstorms were miles apart; therefore, it is unlikely that the aircraft intercepted a cloud-to-cloud lightning strike.

The FDR showed no anomalies that might have indicated any unusual electrical disturbance within the aircraft during this period of time, and there was no recorded ATS communication to indicate that any lightning strike phenomena affected the aircraft. The available information indicates that the aircraft was not struck by lightning.

1.7.7 Weather conditions during descent

SR 111 would have encountered several layers of cloud during its descent, placing the aircraft in instrument meteorological conditions. The first layer of cloud was broken to overcast based at 24 000 to 25 000 feet. The aircraft would have likely entered a second layer of cloud at around 16 000 feet. The base of this layer was approximately 12 000 feet over the Halifax International Airport, sloping down to 7 000 feet over the Halifax Shearwater Airport.

As SR 111 proceeded north of the Peggy's Cove area at 10 000 feet, it is likely the aircraft was near the base of a cloud layer and may have temporarily been clear of cloud with good night flight visibility. As SR 111 headed south toward the ocean and began descending, it is likely that it would have entered a second layer of cloud. It would have entered a third layer at approximately 5 000 feet, and exited the layer no lower than 1 500 feet. Below 1 500 feet, the flight visibility was reported to be good and was likely unobstructed by cloud with the possibility of some light precipitation and fog over the water. When SR 111 was tracking toward the ocean, it would likely have been dark over the sea because of the cloud cover, mist, and lack of surface lights.

See the supporting technical information on this topic.

1.8 Aids to navigation

All ground-based navigation aids in the Halifax area were recorded as serviceable at the time of the occurrence.

See the supporting technical information on this topic.

1.9 Communications

This section provides information on aeronautical mobile and fixed service air-to-ground and ground-to-air communications, and their effectiveness at the time of the occurrence.

1.9.1 General

All recorded communications between SR 111 and the various air traffic control (ATC) units involved with the flight were of good technical quality; that is, all of the recording equipment functioned normally and the sound quality was up to the normal standard. All ground-based radio communications facilities related to the SR 111 flight were serviceable. Boston Air Route Traffic Control Center (ARTCC) experienced a 13-minute communications gap with SR 111, starting at 0033 and ending at about 0046. Information concerning the 13-minute communications gap is provided in sections 1.18.8.2.2 and 2.11 of this report. Other than this anomaly, no communications interruptions or discrepancies were reported by ATS or by any other aircraft along the route flown by SR 111 during the time of the flight.

1.9.2 Controller training

Nav Canada provides annual refresher training for controllers on relevant topics using basic lesson plans based on information in the Air Traffic Control Manual of Operations (ATC MANOPS) and other sources. The ATC MANOPS information on emergency procedures emphasizes air traffic separation responsibilities and administrative duties of controllers. In their aircraft emergencies training, controllers are expected to use their best judgment in handling situations not specifically covered, because it is impossible to detail procedures for all emergency situations. Information provided reminds controllers that "when an emergency occurs, time is of the essence, so all questions must be clear and concise. In order to respond effectively, the controller must rely on the information that the pilot provides." Throughout the occurrence, the controller took his lead from the pilot, believing that the pilot was the one who could best determine the nature of the situation in the aircraft, the nature of his requirements, and what he wanted the controller to do. Prior to this occurrence, controllers were provided basic training on how to respond to aircraft emergencies, but did not receive basic or continuation training on the flight and general operating requirements of aircraft in abnormal or emergency situations. In particular, controllers did not receive training on aircraft general operating procedures for fuel dumping and on basic indications they could expect from the aircraft.

1.9.3 Transition procedures and controller communications

The usual transition procedure for an aircraft in high-level airspace inbound to Halifax is to transition from a high-level en route air traffic controller to a low-level airspace controller, and then to a third controller responsible for traffic within the Halifax terminal control area. The airspace is controlled by the Moncton ACC, located in Riverview, New Brunswick. In this instance, the high-level en route controller coordinated with both the low-level controller and the Halifax terminal controller to reduce the number of RF changes required and to help expedite the descent. At 0118:16, the high-level en route controller instructed SR 111 to contact the Halifax terminal controller on frequency 119.2 MHz. Moncton ACC allocated one controller, with exclusive use of frequency 119.2 MHz, to meet the communications needs of SR 111 on approach to Halifax.

A detailed comparison was made between the transcript of the ATC transmissions and the recommended phraseology in the Nav Canada ATC MANOPS. Although there were occasional instances of minor omissions or substitutions, there was no indication that any of the advisories, clearances, or requests made by ATC were misunderstood or missed by the crew of SR 111. Similarly, the transmissions by the pilots of SR 111 were consistent with accepted industry standards and practices.

1.9.4 Emergency communications

When pilots transmit a message to indicate an abnormal situation or condition, the degree of danger or hazard determines the terminology to be used. A situation in which the safety of the aircraft or of a person on board is threatened, but that does not require immediate assistance, is a condition of urgency. The internationally recognized spoken expression for urgency is "Pan Pan," which is spoken three times in succession. A situation in which the safety of the aircraft or a person on board is threatened by grave and imminent danger, and that requires immediate assistance is a condition of distress. The internationally recognized spoken expression for distress is "Mayday," which is also spoken three times in succession. If the pilots already have the ATS controller's attention, it has become common practice for them to declare an "emergency," instead of using the term "Mayday." This practice is accepted within the aviation industry.

Nav Canada requires controllers to comply with the directives about emergency communication contained in the ATC MANOPS, Part 6, "Emergencies." Subpart 601 instructs controllers to provide assistance to the aircraft in distress, to use all available facilities and services, and to coordinate with concerned agencies. As well, the ATC MANOPS advises that controllers should keep flight crews accurately informed and exercise their best judgment in difficult situations.

The pilots of SR 111 and the controllers communicated in normal tones in all of their communications prior to the pilots declaration of an "emergency" situation. When the pilots declared an emergency at 0124:42, there was a slight elevation in their voices that reflected a higher sense of urgency. From the time of the Pan Pan call at 0114:15, the controllers at Moncton ACC treated the situation as they would treat an emergency; that is, they responded in the same way they would have had pilots made a Mayday call. Moncton ACC responded to the diversion situation, and their actions were in accordance with their standard practice.

1.9.5 Air traffic services communication regarding fuel dumping

Fuel dumping information for Nav Canada air traffic controllers is contained in Part 7 of the ATC MANOPS. Section 701, "Fuel Dumping," instructs controllers to obtain information about the track, the time frame for dumping, and the in-flight weather conditions. As well, controllers are advised to encourage an aircraft to dump fuel on a constant heading over unpopulated areas and clear of heavy traffic. Controllers are also advised to restrict the altitude to a minimum of 2 000 feet above the highest obstacle within 5 nm of the track, and arrange for a warning to be broadcast frequently on ATC frequencies during the period of the fuel dump.

Additional fuel dump information for controllers in the Moncton ACC is contained in the Moncton ACC Operations Manual, 07-98. Section 3.20 identifies the preferred fuel dumping area for the Halifax area and instructs controllers to advise the appropriate flight service station (FSS) or stations.

After verifying with the pilots that a turn to the south was operationally acceptable to the crew, the controller chose a planned location for the SR 111 fuel dump, which was over St. Margaret's Bay, at an altitude above 3 000 feet. This location complied with ATS guidelines and would position the aircraft for a turn onto the on-course for the back-course approach to Runway 06.

When SR 111 advised the controller of the requirement to fly manually without further elaboration, the controller assumed that manual flight was a Swissair procedure to be followed during fuel dumping. When the pilots did not acknowledge the controller's clearance to commence fuel dumping, and when immediately thereafter the aircraft's Mode C transponder stopped providing data to the ATS radar, the controller interpreted this cessation of information from SR 111 to be the result of an electrical load-shedding procedure that Swissair used during fuel dumping operations. This interpretation was based on the controller's experience with military aircraft refuelling exercises carried out over Nova Scotia during which military fighter aircraft receiving fuel typically turned off unnecessary electronics, including the transponder.

See the supporting technical information on this topic.

1.10 Aerodrome information

Halifax International Airport is 14 nm north-northeast of Halifax, at an airport elevation of 477 feet. ATC services for the Halifax airport are provided by radar controllers in the Moncton ACC and airport controllers in the Halifax ATC tower. The airport has runways oriented in two directions: Runway 15/33, which is 7 700 feet long; and Runway 06/24, which is 8 800 feet long. The runways are 200 feet wide and have an asphalt surface. The landing distance available for all the runways is equivalent to their full length.

Runways 24 and 15 are each served by an ILS approach; and runways 06 and 33 are each served by a localizer back-course approach. Runways 06 and 24 are also each served by an NDB approach. The NDB for Runway 06 is the Golf beacon, which is located on the extended centreline, 4.9 nm from the threshold of Runway 06.

Aircraft Firefighting Services at the Halifax International Airport met the availability and equipment requirements of the CARs. The Aircraft Firefighting Services were activated at 0120 and, within one minute, the response vehicles were in place adjacent to the runway of intended landing.

See the supporting technical information on this topic.

1.11 Flight recorders

This section describes the performance of the flight recorders on SR 111, and the general value of recording devices to safety investigations.

1.11.1 General

The occurrence aircraft was equipped with a digital FDR and a CVR. The FDR was an L3 Communications (Loral/Fairchild) model F-1000, which records about 250 parameters in solid state memory. The recorder contained about 70 hours of continuous flight data, which included the accident flight, and the six previous flights. The FDR, as configured, did not record the parameters "Lavatory Smoke" and "Cabin (Cargo) Smoke." Nor did the FDR record any parameters related to the IFEN system. The data recorded on the FDR was of good technical quality.

The CVR was an L3 Communications (Loral/Fairchild) model 93-A100-81. The recording medium was 1/4-inch tape on a continuous loop. The design provided for a nominal recording time of 30 minutes. The actual length of the CVR recording was 32 minutes, 24 seconds, starting at 0053:17 and stopping at 0125:41. The CVR recorded on four separate tracks: the output of each of the two pilot's audio management units (AMU); the cabin interphone or public address audio, whichever is selected; and the cockpit area microphone (CAM).

The CVR-recorded audio was of fair technical quality overall. Prior to when the pilots donned their oxygen masks, which incorporate a "hot" microphone^{Footnote 48} input to the pilot and co-pilot channels of the CVR, cockpit conversations were recorded only on the CAM channel. While in cruise flight, the pilots were not using their headsets, which incorporate integral boom microphones that provide better quality CVR recording than does the CAM. The industry norm is to not use the headsets while cruising at high altitude, and there was no regulation or company policy requiring them to do so. Despite extensive filtering attempts, some of the audio information recorded by the CAM on the CVR was difficult or impossible to decipher because of masking, either by the ambient cockpit noise, or by background ATS radio communications emanating from the cockpit speaker. The pilots' internal verbal communication was mostly in the Swiss-German language.

1.11.2 Recorder installation power requirements

The CVR was powered by the 115 V right emergency AC bus and the FDR was powered by the 115 V AC Bus 3. Both buses are part of the 115 V AC Generator Bus 3 distribution system.

FAR 25.1457 (CVR), FAR 25.1459 (FDR), and the equivalent JARs, require that recorders be installed so that they receive power from the electrical bus that provides the maximum reliability for operation without jeopardizing service to essential services or emergency loads. Transport Canada's Canadian Aviation Regulations Standards Part V–Airworthiness Manual, Chapter 551, Articles 551.100 and 551.101 state that the FDRs and the CVRs shall be installed in accordance with the European Organisation for Civil Aviation Equipment (EUROCAE) documents ED-55 and ED-56A respectively. Additionally, the EUROCAE^{Footnote 49} references suggest that the FDR and the CVR be powered by separate sources.

Initially on the DC-10, the FDR was electrically powered by the 115 V AC Bus 3, and the CVR from 115 V AC Bus 1. However, for JAA certification, the CVR had to be powered by the 115 V right emergency AC bus, which is in turn powered by Generator Bus 3. As a result, both recorders were powered by the same source: Generator Bus 3. The MD-11 emergency checklist dealing with smoke/fumes of unknown origin requires the use of the SMOKE ELEC/AIR selector. This selector is used to cut power to each of the three electrical buses, in turn, to isolate the source of the smoke/fumes. The nature of this troubleshooting procedure requires that the selector remain in each position for an indeterminate amount of time, typically at least a few minutes. When the SMOKE ELEC/AIR selector is placed in the first (3/1 OFF) position, AC Generator Bus 3 is turned off, thereby simultaneously disabling the FDR and the CVR. With both the CVR and the FDR on the same generator bus, a failure of that bus, or the intentional disabling of the bus (e.g., as a result of checklist actions in a smoke situation), will result in both recorders losing power simultaneously.

1.11.3 Stoppage of recorders

Examination of various recovered aircraft system components show that the 115 V AC Generator Bus 3 was powered at the time of impact. On the base portion of the SMOKE ELEC/AIR selector that was recovered, there were indications that the selector was in the NORMAL position at the time of impact.

The CVR and the FDR both stopped because of the loss of electrical power during a 1-second time frame starting at 0125:41, which occurred 5 minutes, 37 seconds, before the aircraft struck the water. Two possibilities were examined to determine why the recorders stopped. The first was that the pilots selected the SMOKE ELEC/AIR selector to the 3/1 OFF position. The second was that a fire-related failure or failures led to the loss of electrical power to both recorders.

Selecting the SMOKE ELEC/AIR selector to the first position (3/1 OFF) would cause the two flight recorders to stop at exactly the same time, as the 115 V AC Generator Bus 3 is taken off-line.

The FDR data indicates that a brief power interruption to the digital flight data acquisition unit (DFDAU) occurred less than two seconds prior to FDR stoppage. This power interruption could not have been a result of selecting the SMOKE ELEC/AIR selector, as this would have resulted in an immediate shut down of the FDR and the CVR. A warm start re-initialization (reboot) of the DFDAU took place following the power interruption. The CVR also showed a discontinuity in recording within two seconds prior to CVR stoppage. These interruptions and discontinuities introduce variability in the relative timing between the two recordings and consequently in the precise relative stop times. It was possible to achieve a degree of time synchronization (less than one second between the CVR and the FDR). On the basis of time synchronization alone, it was not possible to determine whether the recorders stopped as a result of the SMOKE ELEC/AIR selector being selected to the 3/1 OFF position; other information was used to make this determination.

It is known that the pilots started the Smoke/Fumes of Unknown Origin Checklist by selecting the CABIN BUS switch to the OFF position. Prior to making that selection, the captain alerted the first officer about this action and received confirmation from him. The next action item in that checklist was the selection of the SMOKE ELEC/AIR selector. There are several indications that the flight recorders did not stop as a result of the use of the SMOKE ELEC/AIR selector. First, prior to the stoppage of the data recorders, the pilots made no mention of the SMOKE ELEC/AIR selector. Because the captain notified the first officer prior to selecting the CABIN BUS switch to the OFF position, the captain would likely have notified the first officer of his intention to move the SMOKE ELEC/AIR selector, as the first officer was the pilot flying and choosing the selector would have affected systems he was using. In addition, about 9 seconds after the flight recorders stopped, ATC began receiving Mode C (see Section 1.18.8.26) altitude data information from SR 111 for approximately 20 seconds. For this to have occurred, ADC-2, which is powered by the 115 V right emergency AC bus, had to be functioning. This bus would not have been powered if the SMOKE ELEC/AIR selector was in the first (3/1 OFF) position; therefore, it is very likely that this selector was in the NORM position when the recorders stopped recording.

1.11.4 Lack of CVR Information

The CVR in the occurrence aircraft had a 30-minute recording capacity; this met the existing regulatory requirements. The requirements were predicated upon the technology available in the early 1960s, and 30 minutes represented the amount of recording tape that could reasonably be crash protected. Current technology easily accommodates increased CVR recording capacity. The majority of newly manufactured, solid-state memory CVRs have a two-hour recording capacity; however, regulations pertaining to HB-IWF at the time of the accident did not require more than the 30-minute CVR recording capacity.

The earliest information on the SR 111 CVR was recorded approximately 17 minutes before the unusual smell was detected by the pilots. Conversations and cockpit sounds prior to the beginning of the CVR recording would have been useful in looking for potential initiating or precursor events that led to the in-flight fire.

Aircraft electrical power to the SR 111 flight recorders was interrupted at about 10 000 feet, which resulted in the FDR and the CVR recording stoppage. The aircraft continued to fly for about 5.5 minutes with no information being recorded.

Modern, maintenance-free, independent power sources and new-technology CVRs make it feasible to provide independent CVR and CAM power for at least several minutes. This would allow the continued recording of the acoustic environment of the cockpit, including cockpit conversations and ambient noises, in the event of the loss of aircraft power sources.

Current battery technology would not provide sufficient independent power to allow for the same option for FDR information. The multiple sensors and wiring that feed information to the DFDAU require aircraft power.

1.11.5 Quick access recorder

Initiatives undertaken by airlines, such as the development and implementation of increasingly complex flight operational quality assurance programs, require that an increased number of data sets be recorded. Quick access recorders (QAR) were developed because information in FDRs was not easily accessible for routine maintenance and monitoring of aircraft systems. This type of recording has been done on QARs, which are not required by regulation. Most QARs in use routinely record far more data parameters, at higher resolution and sampling rates, than do FDRs.

Unlike FDRs, QARs are not designed to survive in a crash environment. From the numerous pieces of magnetic tape recovered from the aircraft wreckage, 21 individual segments were identified as likely being from the aircraft's QAR. Attempts were made to extract information from the QAR tape; however, it was not possible to extract meaningful information from any of the pieces.

The QAR installed on SR 111 had a tape-based cartridge that recorded approximately 1 400 parameters, which is about six times the number of parameters recorded on the FDR. The additional data recorded on the QAR included numerous inputs that could have been valuable to the investigation. Such information could have assisted in determining the serviceability of aircraft systems prior to, during, and after the initial detection of the unusual smell and subsequent smoke in the cockpit.

Investigative agencies have traditionally promoted the view that additional parameters should be added to those already recorded on FDRs. Typically, the recording capacity of FDRs has not been the limiting factor; rather, these initiatives have been tempered by the high costs of installing the necessary equipment into the aircraft, including the additional data sensors and associated wiring. An additional limiting factor has been the high cost of obtaining certification for the changed mandatory FDR data set.

Modern FDRs, which employ the same solid state memory technologies as modern QARs, make it technically feasible to capture the QAR information within the FDR in a crash-protected environment. However, current regulations do not require that this be done.

1.11.6 Lack of image recording

The SR 111 cockpit was not equipped with an image recording device, nor was this type of device required by regulation.

Recently it has become economically realistic to record cockpit images in a crash-protected memory device. New "immersive" technology provides for economical single-camera systems that can capture a 360-degree panoramic view of the cockpit environment. Special playback software allows investigators to "immerse" themselves in the cockpit and virtually view the entire cockpit.

Such a capability could have been valuable during the SR 111 investigation; the investigation could have been expedited and potential safety action more easily identified.

See the supporting technical information on this topic.

1.12 Wreckage and impact information

This section describes the wreckage recovery process and methods, as well as the condition of the recovered pieces. In some instances, interpretations of the significance of the condition of recovered pieces are made.

See the supporting technical information on this topic.

1.12.1 Wreckage recovery

1.12.1.1 General

The search and rescue response to the event was immediate, and included resources from the Canadian Forces (CF) (Department of National Defence (DND)), Canadian Coast Guard (Department of Fisheries and Oceans), the Royal Canadian Mounted Police (RCMP) (Department of the Solicitor General of Canada), and numerous private individuals in boats from the local area. An exclusion zone was put in place to protect the site and to provide security during recovery operations. The exclusion zone was removed on 1 November 1999. Until that time, there was continuous security in place, and no known breaches of security occurred. Recovery and sorting of the wreckage took approximately 15 months to complete.

The wreckage site was located when the submarine HMCS Okanagan homed in on the underwater locator beacons (ULB) from the flight recorders. Various ship-borne underwater imaging technologies, divers, and video cameras on remotely operated vehicles (ROV), provided information about the wreckage condition and dispersion. The main debris field measured approximately 125 by 95 m (411 by 312 feet). The water depth was about 55 m (180 feet).

The focus of the initial recovery phase was on finding and recovering human remains, and on locating the CVR and the FDR. Extensive surveillance of the wreckage field and the surrounding area was completed to assess the various recovery options. Floating wreckage was scattered by wind and water currents, but no major piece of wreckage was found outside the confines of the irregularly shaped, single debris field on the seabed. Some of the wreckage recovery methods, as described in the sections that follow, spread wreckage over a wider area.

Wreckage recovery operations yielded over 126 554 kg (279 000 lb) of aircraft material, which represented approximately 98 per cent of the structural weight of the aircraft. Over 18 144 kg (40 000 lb) of cargo was also recovered.

See the supporting technical information on this topic.

1.12.1.2 Wreckage recovery methods

1.12.1.2.1 Initial wreckage recovery methods

Initial wreckage recovery activities included collecting debris from the surface of the water, searching shorelines, shallow water dive operations near shoreline areas, and deep dive operations at the debris field.

Divers from the Canadian Navy recovered the FDR on 6 September 1998 and the CVR on 11 September 1998. There was some delay in recovering the first recorder because both recorders were equipped with water-activated ULBs that were transmitting on the same frequency. Once the general area of the beacon signal was located, it was difficult to pinpoint the precise location of either of the recorders.

The ULB attachments were damaged to the extent that they had nearly become detached from the recorder. There is no regulatory requirement that the recorders be tested and certified with the ULBs attached.

Beginning on 12 September 1998, the USS Grapple, a United States Navy (USN) salvage ship, was on site for approximately three weeks, adding additional lift, dive, and ROV capabilities.

The continued use of divers to recover wreckage was assessed as hazardous owing to increasingly inclement weather; deteriorating sea state conditions; water depth; and the sharp, jagged state of the wreckage. It was also recognized that at the rate the wreckage could be recovered using this method, the majority of the wreckage would not be recovered in a timely manner, and that higher-capacity methods would have to be employed.

Between 6 804 and 9 072 kg (15 000 and 20 000 lb) of material was recovered during the initial recovery operations.

See the supporting technical information on this topic.

1.12.1.2.2 Heavy lift operations

Between 13 October and 24 October 1998, two contracted barges, moored together, were used to recover material from the debris field (see Figure 18). A heavy lift crane on the deck of one barge scooped wreckage from the seabed and placed it on the deck of the second barge, where it was sorted and washed. The wreckage was then transported to shore by CCG ships for further processing.

Approximately 68 040 kg (150 000 lb) of wreckage was recovered using this method.

1.12.1.2.3 Scallop dragger operations

A scallop dragger was used from late October 1998 to mid-January 1999. A scallop rake that was towed behind the vessel scraped the seabed and collected material into a chain-link mesh net. Working 24 hours per day when the sea conditions were suitable, 1 839 tows were completed.

Approximately 34 020 kg (75 000 lb) of wreckage was recovered using this method.

1.12.1.2.4 Remotely operated vehicle operations

Various ROVs were used throughout recovery operations to provide reconnaissance and recovery capability. A laser line scan and side scan sonar survey was performed to determine the extent of wreckage distribution and to provide detailed information about the seabed. Following the scallop dragger operation, the recovery area was prepared for the next phase by using ROVs to video tape the seabed in and around the site of the debris field. A CF ROV, called the Deep Seabed Intervention System, was used from 26 April 1999 to 14 July 1999 to recover material that would not be suitable for recovery by the planned suction dredge ship method.

Approximately 2 268 kg (5 000 lb) of wreckage was recovered during these operations, and considerable information about the type and location of the remaining debris was acquired.

1.12.1.2.5 Suction hopper dredge operations

The final phase of wreckage recovery was conducted in the fall of 1999. It involved dredging the area of the debris field to a depth of about 1.5 m (5 feet) to recover the remaining debris. The dredged material was pumped into the vessel's hopper and transported to Sheet Harbour, Nova Scotia, where it was off loaded into a prepared containment area.

The dredged material was then processed through a mechanical sifter to sort it by size, and deposit it on conveyor belts. The aircraft-related debris was then separated from the other material by hand as it passed by on conveyor belts. About 12 701 kg (28 000 lb) of wreckage was recovered using this method.

The sifting and extraction of aircraft wreckage at Sheet Harbour was completed on 3 November 1999, and the subsequent sorting of this recovered debris was completed on 4 December 1999, 15 months after the occurrence.

1.12.2 Aircraft wreckage examination

1.12.2.1 General

Recovered aircraft debris was transported to the CF facilities at Shearwater, Nova Scotia, where it was cleaned and sorted. Each item was examined by the Transportation Safety Board of Canada (TSB) and RCMP personnel with assistance from a large support team of specialists provided by Boeing (aircraft manufacturer), Swissair (operator), and SR Technics (maintenance company). Other investigation agencies, companies, and organizations provided additional specialists as requested by the TSB; for example, the NTSB, the FAA, the United Kingdom Air Accidents Investigation Branch, the Swiss Aircraft Accident Investigation Bureau (AAIB), the French Bureau d'Enquêtes et d'Analyse, the Air Line Pilots Association, Pratt & Whitney, and other companies were represented. Over 350 people participated in the wreckage sorting, examination, and investigation activities at Shearwater.

Recovered items were sorted and classified by their location on the aircraft and by their potential significance to the investigation. Particular emphasis was placed on debris exhibiting heat damage, burn residue, or unusual markings.

Detailed visual inspections and forensic analyses were completed by RCMP personnel to assess the possibility of explosive or incendiary devices having contributed to the observed damage. No evidence was discovered in the aircraft debris to suggest that criminal acts had contributed to the occurrence.

1.12.2.2 Aircraft reconstruction

A full-scale reconstruction mock-up was fabricated to support recovered portions of the forward section of the aircraft (see Figure 19). The original framework encompassed the portion of the aircraft above the cockpit and passenger cabin floors, from the front of the cockpit (STA 275) to STA 595, located within the first-class passenger cabin. Recovered portions of airframe primary structure and skin panels determined to have been installed at identifiable locations from the cockpit enclosure aft to approximately STA 595 were straightened, fracture matched, and installed on the reconstruction mock-up. The reconstruction mock-up was subsequently extended aft to STA 669; a second extension to STA 741 was added to the left side of the reconstruction mock-up to support recovered portions of the two forward air recirculation fans.

1.12.3 Examination of recovered electrical wires and components

1.12.3.1 General

The aircraft wiring was severely damaged by the forces of impact. Additional mechanical damage could have occurred to some of the wiring during recovery operations. Many of the wire segments had been broken into segments between 10 and 100 cm (4 and 39 inches) long.

All of the recovered wires were examined, primarily to identify any with signs of melted copper. As the fire did not reach temperatures high enough to melt copper,^{Footnote 50} any areas of melted copper would indicate that an electrical arcing^{Footnote 51} event had occurred.

Wire segments that showed signs of soot or heat damage, or that could be identified as being from the B section of the aircraft, were segregated from the other wires. The condition of the wires, heat damaged or not heat damaged, was used to help define the boundaries and heat pattern of the fire. The wire examination also assisted in explaining the spread of the fire and the loss of aircraft systems.

Recovered electrical components that had been installed within the fire-damaged area were examined for internal failures; such failures can be a source of heat, and therefore have the potential to be a source of ignition. Examination of these components did not show any evidence of their being involved in the initiation of the fire.

1.12.3.2 Control and tracking of electrical wires

Approximately 250 km (155 miles) of wire was installed in the aircraft. Although 98 per cent of the structural weight of the aircraft was recovered, it is estimated that a slightly lesser percentage of the wire was recovered. The examination of the recovered wire identified several wire segments that exhibited melted copper consistent with electrical arcing damage. Some of the arcing damage was too small to see without magnification. It cannot be assumed that all arced wires were recovered.

During the examination, any wire that was deemed to be of interest to the investigation was tagged, assigned an exhibit number, and entered into a wire database. The database increased to contain information on approximately 3 000 individual wire segments. Segments that exhibited melted copper, or showed signs of significant heating, were tracked through the same exhibit numbering system that was adopted to track pieces of wreckage. The wire segments that exhibited melted copper were further analyzed, which required that the melted sections be cut from the original segment. These individual melted copper wire sections were assigned new exhibit numbers and were tracked within the database. Where practical, the wire segments from the fire-damaged area that were identified as to their location in the aircraft were incorporated into the reconstruction mock-up (see Section 1.19.3).

1.12.3.3 Wires and cables with electrical arcing damage

When metal-to-metal contact occurs between an energized conductor and a source of electrical ground, or between an energized conductor and another conductor of different potential, a short-circuit is created. Typically, a short-circuit will result in an arcing event. Copper or aluminum wire that has arced will typically be identified by an area of resolidified metal (see Figure 20). After the arcing event, as the metal resolidifies from its molten state, it often forms a distinctive bead.^{Footnote 52} Short-circuit arcing will normally trip the associated CB, and typically result in a relatively small amount of conductor being melted.

In an arcing event, copper is vapourized and expands to many thousands of times its volume when in a solid state. High temperatures and pressures are generated in the localized vicinity by this vapourization and by the electrical discharge (arc) as it passes through the surrounding air. If flammable materials are nearby, they can be ignited by the heat of the electrical discharge, by the heat from the gases emanating from the area, or by the molten globules of copper that are typically ejected from the arc site.

With aircraft voltages of 115 V AC, an arcing event without physical contact is very difficult to obtain or sustain. However, in areas where wire insulation is destroyed in a fire environment there is an increased likelihood that such an arc can be initiated and sustained, and that the conductor will melt over some length. This rapid progressive arcing phenomenon, known as arc tracking, depends on numerous variables, the most predominant being the type of insulation used on the conductor.

Among the thousands of wire segments examined from SR 111, areas of melted copper were found on 21 exhibits that consisted of 17 individual wire segments, and 4 cable assembly segments that each comprise 3 separate spirally laid wires (3 individual wires twisted together to make up the one cable). All except one of the conductors that exhibited arcing had either polyimide or ETFE-type insulations. The one exception was a conductor insulated with a modified XL-ETFE (see information about Exhibit 1-3029 in Section 1.12.3.7).

Polyimide insulation does not melt when exposed to elevated temperatures; instead, it will pyrolyze,^{Footnote 53} or thermally degrade. Thermogravimetric analysis^{Footnote 54} of polyimide insulation in air shows that it begins to dissociate^{Footnote 55} at about 500°C (932°F) and will be completely dissociated by 650°C (1 202°F).

One of the characteristics of polyimide insulation is that under the correct conditions it can arc track, either wet or dry. Arc tracking can occur when the polyimide insulation decomposes from heat produced by either an electrical arc or by a fire. The exposure to heat produces an electrically conductive and thermally stable carbon char.^{Footnote 56} The resulting carbon deposit provides a current path to perpetuate the arc. This arcing can further cause the surrounding insulation to decompose, allowing the electrical discharge to propagate, or track, along the wire. In some cases, the current required to form an intermittent or sustained electrical discharge (arc tracking) is below the "current versus time" trip threshold for the associated CB. In these cases, an undetected fault condition, producing intense heat, will develop.

Frequently in an arc-tracking event, the heat from the initial localized electrical discharge will degrade the insulation on adjacent wires, causing a cascade of arcing and burning between multiple polyimide wires in a bundle. This is referred to as flashover. Flashovers can result in the catastrophic failure of entire wire bundles, resulting in the loss of power or signals to all equipment supplied by the affected wires.

Unlike polyimide insulation, ETFE insulation will melt and burn. It melts in the 260°C to 270°C (500°F to 518°F) range, and will burn with a flame when exposed to a fire at temperatures above 500°C (932°F). When the flame source is removed, ETFE insulation is self-extinguishing. The FAA testing of ETFE has shown that it will not support wet or dry arc tracking. The thermal decomposition of ETFE does not result in the formation of a conductive carbon char.

Testing has shown that although the ETFE insulation will melt and volatilize relatively quickly in a fire environment, it can be difficult to initiate a conductor-to-conductor or conductor-to-ground arcing event in a fire environment. The testing, using a butane flame to melt ETFE insulation, showed that it could take 20 to 30 minutes for arcing to occur between adjacent conductors. This suggests that a small creeping flame on an insulation blanket would be unlikely to degrade ETFE insulation and result in an arcing event in the time it would take for the flame to consume the available insulation blanket material and move away.

This testing also showed that in some cases the associated CB would immediately trip with the first arcing event; however, in other cases several arcing events would occur before the CB tripped. Neither the time to arc nor the tripping of the CB is predictable in a fire environment. If the initial arcing event does not trip the CB, arcing can occur on the same conductor some distance apart as the fire propagates and affects other sites on the wire.

In addition to the 21 exhibits that displayed copper melt, a single bead of once-molten copper, 2 mm (0.08 inches) in diameter, was recovered. This bead was found trapped in the damaged cooling fins on top of an emergency lights battery pack, which, based upon heat damage, was determined to have been located above the forward cabin drop-ceiling just behind the cockpit door. (See Figure 27.) This bead was likely fractured off, most likely during the impact sequence, from the end of an arced wire in the vicinity of the battery pack. No further determinations could be made about this bead.

One of the copper melts was not a result of arcing damage, but was determined to be the direct result of a welding operation during the manufacturing process of the wire (see Section 1.12.3.7).

See the supporting technical information on this topic.

1.12.3.4 Positioning of wires and bundles from exhibit 1-4372

During the wreckage recovery, one bundle of entangled wires was recovered that yielded 9 of the 20 wire segments that were found to have arcing damage. Collectively, this bundle was designated Exhibit 1-4372 (see Figure 21).

The wire insulation was missing from some of the wire segments, having been burned off by the fire or damaged by the fire and then stripped away at the time of impact. It is also possible that some additional wire insulation damage took place during the wreckage recovery process.

Several of the wire segments in Exhibit 1-4372 were identified as belonging to one of three aircraft wire runs (FAC, FBC, and FDC) (see Figure 7). As installed, these three wire runs, along with wire runs AAG, ABG, and the IFEN wire bundle, ran parallel to each other on the right side of the fuselage over top of Galley 2, between the cockpit rear wall at STA 383, and the aft end of Galley 2 at approximately STA 420. Just forward of the aft cockpit wall, the IFEN wire bundle entered one of two spare 102-cm (40-inch) long conduits that were installed between STA 383 and STA 420 (see Figure 5).

At STA 420, wire runs FAA, FBA, and FDA were broken out of wire runs FAC and FBC and FDC respectively. At STA 420, wire runs FAA, FBA, and FDA, along with wire runs AAG and ABG were routed over the crown of the aircraft to the left side of the fuselage. At STA 420, wire runs FAC, FBC, and FDC dropped down to run across the top of the forward passenger cabin ceiling; this routing was chosen to avoid contact between the bundles and the R1 door in the open position.

The recovered segments of wire runs FBC and FDC were each approximately 2.5 m (100 inches) long and had two wire clamps, identified as the marriage clamp, still attaching them together. The two wire runs were accurately positioned in the reconstruction mock-up based on the positive identification of individual wires, and by identifying the installed position of the marriage clamp at approximately STA 427. When these cable segments were positioned in the reconstruction mock-up, the forward end was located near the cockpit rear wall, and the aft end was located near STA 475. Accurate positioning of the segments from wire runs FDC and FBC, based on the known location of the marriage clamp, allowed for improved accuracy when positioning other wires from the same area. Heat damage patterns were used in the positioning of other wires from the same area.

1.12.3.5 Identification and description of arc-damaged wires from exhibit 1-4372

Of the nine wire or cable segments with areas of melted copper that were recovered from Exhibit 1-4372, four were positively identified as being segments of the IFEN PSU cables (1-3790, 1-3791, 1-3792, and 1-3793) (see Figure 22). This identification was based on remnants of coloured ETFE insulation remaining attached to the wires. On each of these four segments, one end was heavily matted, or crushed together, and the opposite end was fractured and frayed. Exhibits 1-3790 and 1-3792 both had distinctive regions where the tin coating was missing from the wire strands on all three wires. Exhibits 1-3791 and 1-3793 did not have a similar region of missing tin.

Of the remaining five segments, based on adhering remnants of ETFE insulation, four (1-3794, 1-3795, 1-3788, and 1-10503) were identified as segments of the 16 AWG IFEN 28 V DC control wire used to control the PSU outputs. The total length of these four segments was 97 cm (38 inches). The fifth (1-3796) was a segment of polyimide-film-insulated, nickel-coated 16 AWG wire. This wire segment could not be associated with a specific circuit; however, because it was nickel coated, it is known that it was not from the IFEN system.

The copper melt on Exhibit 1-3796 was unique in that it had an area of melted copper that encapsulated all of the outer wire strands over a distance of 2 cm (0.79 inches); however, the melted copper still had nickel-coated wire strands protruding at both ends, indicating that the heat was highly localized and confirming that an arcing event occurred.

When Exhibit 1-4372 was being untangled, Exhibit 1-3796 was removed from wire run FBC at a position corresponding to approximately 79 cm (31 inches) forward of the known location of the marriage clamp. Although this corresponds to a location aft of the cockpit wall, it cannot be confirmed that this is where this segment of wire had been installed.

Wire run FBC did not contain any 16 AWG wires; however, 16 AWG wires were contained in adjacent wire runs. FAC had 25, FDC had 2, and ABG had 1. In total, there were twenty-eight, 16 AWG wires routed, within these various wire runs, above the Galley 2 area. It could not be determined whether Exhibit 1-3796 originated from one of these cable runs, and if it did, which one.

1.12.3.6 Examination of the nine arced wires and cables

To assess whether the four IFEN PSU cable segments (1-3790, 1-3791, 1-3792, and 1-3793) and four control wire segments (1-3794, 1-3795, 1-3788, and 1-10503) had been located inside the conduit, they were submitted to the RCMP Chemistry Division (Ottawa and Halifax) for analysis. The single control wire (1-10503) was not submitted; except for one small piece of ETFE insulation, it was bare. The nickel-coated 16 AWG segment was also submitted to determine whether any FEP material had transferred to it during the impact sequence; this was to determine the proximity of this wire segment to the conduit. Furthermore, a request was made to identify any other materials found on these exhibits. Samples of the FEP conduit, the nylon clamps used to support the conduit, tie-straps, and other materials were supplied for comparative analyses. See Table 12 for the results of this testing.

Exhibit 1-3791 was also submitted to the Canadian DND Quality Engineering Test Establishment for further chemical analysis of the debris entrapped in the matted end, adjacent to the area of melted copper identified as Exhibit 1-14723.

Each of the four PSU cables consisted of three individual wires (three electrical phases). It was not possible to determine which wire had been used for which phase; therefore, each wire was arbitrarily labelled either phase A, B, or C.

Table 12 details the results of the physical and chemical examinations on the nine wire and cable segments recovered from Exhibit 1-4372. The matted ends of the four PSU cables were straightened. The cables were then measured from the straightened ends to determine the overall length of each phase and the distance to each arc location. Figure 22 depicts the locations of the arcs and other distinguishing features on the cables, relative to each other.

Table 12. Summary of examination of arced wires from exhibit 1-4372

Exhibit number number of wires/gauge (AWG) wire length (cm)	Melted copper on phase (ph) @ distance from straightened end (cm)	Chemical analysis		Other observations
		FEP present (cm)*	Nylon (cm)*
1-3790 (IFEN) 3/12 AWG ph A - 88 ph B - 112 ph C - 100	ph A - 11 (1-14746) ph A - 62 (1-12652) ph B - 77 (1-12651) ph C - 69 (1-11182)	0 to 15, ph A - 46 ph C - 3 ph C - 13 ph C - 46 91 to 102	86 to 97	Tin coating missing between 58 and 89 cm. Small pieces of red silicon rubber material 10 cm from end. Yellow fibreglass insulation embedded in matted end.
1-3791 (IFEN) 3/12 AWG ph A - 115 ph B - 116 ph C - 117	ph A - 9 (1-14723) ph A - 62 (1-12653) ph B - 65 (1-12654)	0 to 15, ph B - 10 ph B - 37 ph B - 54 76 to 91	91 to 107	1-14723 was within matted end of wires. Small pieces of red silicon rubber material and yellow fibreglass insulation embedded in matted end.
1-3792 (IFEN) 3/12 AWG ph A - 97 ph B - 97 ph C - 104	ph A - 22 (1-12668) ph B - 23 (1-12666) ph B - 23 (1-12667)	15 to 30 ph A - 45 ph A - 48 ph C - 53 ph C - 98 91 to 104	0 to 15	Tin coating missing between 58 and 89 cm. Small pieces of red silicon rubber material 13 cm from end.
1-3793 (IFEN) 3/12 AWG ph A - 102 ph B - 120 ph C - 120	ph A - 64 (1-12669) ph A - 66 (1-12670) ph A - 67 (1-12732)	0 to 15, ph B - 7 ph C - 37 ph C - 43 ph C - 54 45 to 61	91 to 107	Small pieces of red silicon material 9 cm from end of longest wire at matted end.
1-3788 (IFEN) 1/16 AWG 31 cm	End of wire - (1-11166)	9 (from melted end)		Frayed wire strands at opposite end of melted copper missing tin coating.
1-3794 (IFEN) 1/16 AWG 23 cm	End of wire - (1-11167) and 2 cm from melted end (1-11168)	9 and 19 cm from melted end		Tin missing from outer wire strands over last 7 cm from melted end. Small pieces of red silicon rubber material noted between strands.
1-3795 (IFEN) 1/16 AWG 31 cm	End of wire - (1-11173)	No FEP found		Tin missing from strands over 6 cm from melted end and again 10 cm farther along wire for 10 cm; tin was present over the last 6 cm.
1-10503 (IFEN) 1/16 AWG 13 cm	End of wire - (1-11163)	Not submitted		Tin coating missing over 2.5 cm from melted end.
1-3796 1/16 AWG 27 cm	3 cm in from end of wire and 2 cm long (1-11175)	No FEP found		Nickel-coated wire with a small piece of polyimide film trapped in wire strands.

* The RCMP Halifax analysis reported FEP and nylon in ranges whereas the Ottawa analysis stated a distance from an end.

1.12.3.7 Examination of identified aircraft systems wires with copper melt

Four wire segments with regions of copper melt were positively identified from wire numbers marked on their insulation. Three of these four wires had a terminal lug connector still attached to one end, allowing the wires to be accurately positioned in the reconstruction mock-up.

All four of these wire segments originated from behind the overhead CB panel, which constitutes the upper part of the overhead switch panel (see Figure 23). The switch panels and CB panel are attached to a fibreglass enclosure, referred to as a "housing," within which terminal strips, bus bars, and other components are mounted. The wires are routed into and out of this housing through two holes located on the left and right sides of the aft end of the housing.

Exhibit 1-6976 consists of a segment of a 6 AWG nickel-coated, polyimide-insulated wire, approximately 102 cm (40 inches) long with the wire number B205-4-6 stamped on the insulation. This number identifies it as a segment of the left emergency DC bus feed wire. One end of the wire segment had two flag lugs attached that would have been connected to the left emergency DC bus bar located behind the overhead switch panel. The known location of the flag lug to bus bar connection allowed for this segment to be accurately located in the reconstruction mock-up. The end with the melted copper was located approximately 15 cm (6 inches) outside the right hole in the overhead CB panel housing. This placed it above the forward right side of the cockpit ceiling.

There was a 2-cm (0.8-inch) long section of resolidified copper located about 97 cm (38 inches) from the flag lugs. The nickel coating was missing from the conductor, for about 6 cm (2.4 inches) on either side of the melted area. The outer surface of the resolidified copper was smooth and did not exhibit any of the normal characteristics associated with an arcing event, such as surface porosity or irregular surface structure. Radiographs of this area showed it to be a solid mass, without voids. This was the only nickel-coated wire segment that exhibited melting of the nickel coating beyond the area of the resolidified copper. This melted copper was considered to have been the direct result of a welding operation during the manufacturing process of the wire.^{Footnote 57}

Welding or "splicing" is done to avoid interruptions during the wire manufacturing process. Spliced joints are required to be flagged and removed prior to the wire being installed in an aircraft. If not removed, such a solid piece of copper conductor, especially larger gauge wires, such as the 6 AWG wire, can be susceptible to fatigue cracking. The left emergency DC bus feed wire was installed in the occurrence aircraft in a location where the wire run was relatively straight, and the vibration potential was low. These mitigating factors would reduce the risk of fatigue cracking; there was no sign of fatigue cracking in the melted area of Exhibit 1-6976.

Exhibit 1-3029 was identified by the wire number B205-1-10 as being a segment of the left emergency AC bus feed wire (see Figure 20). Although this wire was identified by the Boeing wiring database as a nickel-coated, polyimide-insulated wire, it was in fact an XL-ETFE (BXS7008) insulated tin-coated wire. The recovered segment was approximately 122 cm (48 inches) long. One end of the wire segment had two flag lugs attached, which would have connected it to the left emergency AC bus bar. The end opposite the flag lugs exhibited melted copper on the surface of the conductors. As installed, the end with the melted copper would be located approximately 15 cm (6 inches) outside of the right oval hole in the overhead switch panel housing, and in the immediate vicinity of the melted copper on the left emergency DC bus feed wire. The insulation remained intact on this wire, from the flag lug to within 17.5 cm (7 inches) of the melted copper at the other end.

Exhibit 1-1733 was identified by wire number as a segment of B203-974-24, a 24 AWG nickel-coated, polyimide-insulated wire that was identified as part of the Engine 2 fire detection loop "A" circuit. The recovered segment was approximately 39 cm (15 inches) long. One end of the wire segment was attached to a remnant of module block 46 that was originally attached to modular track S3-613, located on the right side of the overhead switch panel housing. The other end of the wire segment exhibited melted copper. The known location of the module block allowed it to be relocated in the reconstruction mock-up of the overhead housing. This placed the area of melted copper approximately 15 cm (6 inches) outside the right oval hole of the overhead switch panel housing.

Exhibit 1-12755 was identified by wire number as a segment of B203-189-22, a 22 AWG nickel-coated, polyimide-insulated wire that was part of the high-intensity lights (supplemental recognition) wingtip strobe lights. The recovered segment was approximately 81 cm (32 inches) long. This wire segment exhibited melted copper on one end, and frayed wires at the other. The frayed wire end did not appear to have had a terminal lug or pin attached to it; it appeared to be a segment from a longer wire. As installed, this wire was routed from the push button switch S1-9094, identified as HI INTENSITY LTS, located in the overhead switch panel, to plug P1-420 pin X located on the overhead disconnect panel behind the upper avionics CB panel. The area of melted copper could not be accurately positioned between the start and end points but the wire was routed in wire runs AMJ and AMK, which are routed out the oval hole in the right side of the overhead switch panel housing.

1.12.3.8 Examination of remaining unidentified wires

The remaining eight wires with arc damage could not be identified regarding their function, nor could their specific location within the aircraft be determined. Table 13 contains a description of these eight wires.

Table 13. Summary of examination of remaining arced wires

Exhibit number	Length (cm)/Wire size/Wire coating/Insulation new exhibit number	Melted copper	Observations
1-4689	19 cm/10 AWG/tin coated/ no insulation remaining (1-11177)	0.2 cm from end. Copper melt encompasses 8 to 9 wire strands 0.3 to 0.5 cm long and 1 to 2 mm wide. Numerous cavities and voids in melt.	Tin coating missing from wire strands. Both ends frayed. Polyimide film caught in strands but could not positively determine whether it is from this wire.
1-11897	16 cm/10 AWG/tin coated/ no insulation remaining (1-12657) (1-12659) (1-12661) (1-12662) (1-12665)	Both ends melted. Straight end of wire 14 cm from curved end. 6 cm from curved end.	Wire embrittled from end to end.
1-12756	40 cm/18 AWG/tin coated/polyimide film insulated (1-12737)	Melted copper over 0.2 cm long, 0.8 cm in from one end and encompassing 8 to 10 wire strands. Numerous voids and craters in melt.	M81381/21 (polyimide insulated/tin coated).
1-11252	7 cm/24 AWG/nickel coated (1-11179)	Melted copper at end extending 0.15 cm down wire. Small bead of copper fused to strands adjacent to melted end.	Wire embrittled from end to end. Nickel coating missing in some areas and charred or blackened material adhering to strands.
1-3713	9 mm/24 AWG/nickel coated (1-3713)	Melted from end to end with no obvious coating remaining.	Numerous voids and holes through wire. No insulation remaining.
1-12809	25 cm/24 AWG/nickel coated (1-12736)	1.2 cm from one end 0.2 cm long encompassing all strands with a small bead protrusion.	No insulation remaining.
1-3700	10 cm/20 AWG/nickel coated (1-11165)	End of wire melted over 1 cm with a 1.5 mm bead on end.	No insulation remaining.
1-3718	28 cm/20 AWG/nickel coated (1-11164)	End of wire melted over 0.6 cm ending in a flatted point.	No insulation remaining. Melt area blackened from smoke.

1.12.4 Examination of flight crew reading lights (Map lights)

The first officer's map light was recovered and examined for electrical arc or heat damage and none was present. The light bulb was still attached to the lamp socket. The lamp filament had fractured into many pieces, indicative of the filament being cold, or off, at the time of impact. Typically, when an incandescent filament is severely impacted while illuminated, it will stretch in a characteristic fashion.

Portions of the right observer's map light, including the ball cup, were recovered and examined. There was no sign of arcing or heat damage; however, the majority of the electrical contact parts were missing. The aluminum housing in which the light was mounted had some soot accumulation on the outer surface but was not heat damaged. Two short lengths of wire, white and red, were visible inside the housing. The white wire exhibited a mechanical fracture; neither wire exhibited evidence of arcing or heat damage. The light bulb was not recovered.

Several pieces of Hella map light were recovered and examined. Because the internal components of the map light and bunk lights are identical, it was not possible to determine to which light these pieces belonged. None of these pieces showed signs of arcing or heat damage.

Two ball cups were also recovered. Based on the physical damage and extent of sooting, they were considered to have been from either the captain's or first officer's map light.

See Section 1.16.2 for additional details regarding map light investigation research and testing, and Section 4.1.4 for follow-up safety actions taken.

1.12.5 Examination of cabin overhead aisle and emergency light assemblies

The passenger cabin was equipped with overhead aisle and emergency light assemblies manufactured by Luminator Aircraft Products (PN 0200486-001). These light assemblies were installed in the bridge/gap assemblies that support the ceiling panels used throughout the passenger cabin above the left and right aisles. Each light assembly includes both an aisle light and an emergency light; however, only the aisle light is illuminated during normal operations. A few recovered bridge/gap assemblies exhibited a single black circular mark and some brown discolouration adjacent to the area where the aisle and emergency light assemblies are mounted.

During subsequent examinations of other MD-11 aircraft, the same discolouration pattern was found on the bridge/gap assemblies. In addition, some aisle light lens covers were found to be deformed. Testing was conducted using temperature measurement strips to determine the temperatures reached within the lens cover adjacent to the lamp and also adjacent to the outside of the aisle light assemblies during normal aircraft operations. Peak internal temperatures of approximately 200°C (392°F) were noted, with average temperatures between 143°C and 160°C (289°F and 320°F). Temperatures between 110°C and 138°C (230°F and 280°F) were measured on the outside of the light assemblies. Discolouration on the bridge/gap assemblies was a result of the heating effects of the aisle light lamp. It was noted that the amount, and frequency, of heat damage increased the longer the light assemblies were in service.

Some of the cabin overhead aisle and emergency light assemblies examined were found contaminated with a heavy build-up of dust and lint. Some contamination was also noted on light ballasts, wire harnesses, and electrical terminal strips and connectors, as well as in some areas above the forward cabin drop-ceiling and elsewhere in the aircraft. In some forms, dust and lint can be highly combustible and may be ignited from a small ignition source.^{Footnote 58} Concentrations of dust and lint could provide a path for fire propagation. Microscopic examination and analysis of dust and lint collected from filters removed from Swissair aircraft indicated that the deposits consisted of a mixture of different materials, such as textile and paper fibre fragments. The deposits were determined to be flammable^{Footnote 59} and easily ignitable from a small ignition source.

See the supporting technical information on this topic.

1.12.6 Examination of standby instruments

The SAI was recovered and examined to determine whether it was electrically powered and functional prior to impact, and to determine whether the indicator could help determine the attitude of the aircraft at the time of impact. The indicator's casing was extensively deformed from impact damage. This deformation resulted in capturing the pitch and roll indicators at approximately 110 degrees right bank and 20 degrees pitch down. The attitude scale showed a distinct red imprint that matched the shape and size of the red warning flag. The flag comes fully into view in less than one second with the loss of electrical power to the unit, or if the rotational speed of the gyro falls below 18 000 rpm. The location of the imprint showed that the warning flag had been fully displayed at the time of impact.

The shaft of the gyro rotor mass was fractured in torsional overload; there were superimposed rotational rub markings. Both the rotor mass, and the housing, exhibited surface rub. There was a transfer of machine tool markings between the two. This is indicative of there having been high rotational speed when the rotor mass contacted the enclosure, which would have occurred when the support shaft fractured. Therefore, it is concluded that at the time of impact, the gyro was rotating with high rotational energy.

If electrical power to the SAI is lost, the rate of spool-down of the gyro will allow the indicator to continue to provide reliable attitude information for five to six minutes. Electrical power to the unit is provided from the aircraft's battery bus, through CB C-01 located on the overhead CB panel.

The only part of the standby altimeter/airspeed indicator that was identifiable was the airspeed dial drum. The dial drum was extensively deformed; however, it exhibited two distinct indentations at the 80 knot and 120 knot graduations. These two indentations appear to have been made at the time of impact by contact with two internal supports that were located at the rear of the indicator, but in close proximity to the drum as it rotates. Using a serviceable airspeed indicator, the indentations on the airspeed dial drum were lined up with the internal supports. The comparison placed the 300 knot graduation at the airspeed index mark, indicating that the aircraft was travelling at about 300 knots at the time of impact.

1.12.7 Examination of flight controls

The flight control system actuators were examined; there was no indication of a pre-impact fault within the actuator assemblies that would have affected their normal operation. Based on this examination, the flaps were extended to 15 degrees; however, the slats were not extended as would be expected with flap extension. Electrical power is not required for flap extension; however, it is needed for slat operation. The failure of the slats to extend was likely the result of an interruption in electrical power to the slat control valves owing to the effects of the in-flight fire.

With a flap extension of 15 degrees, the outboard ailerons would have become active. The spoilers (speed brakes) were retracted at the time of impact; however, it is unknown whether they were deployed at any time during the descent below 10 000 feet after the loss of the FDR. Impact markings on the elevator, rudder, and aileron actuators, along with the as-recovered positions of the horizontal stabilizer jack screws indicate the following possible aircraft flight control configuration at the time of impact: 2 to 3 degrees up-elevator; 3 degrees left rudder; and ailerons and horizontal stabilizer in a neutral position.

The FDR recording, just prior to the loss of the FDR, showed no anomalies with the flight control systems. The last valid recordings indicated that the autopilot had disengaged and the upper and lower yaw damper A control was lost (the upper and lower yaw damper B control was still available). When the FDR recording stopped, the aircraft was in a "clean" configuration, with the flaps, slats, and landing gear retracted.

See the supporting technical information on this topic.

1.12.8 Examination of fuel system components

All 17 of the 115 V AC motor-driven fuel pumps were recovered, and all but two were specifically identified as to their installed location. Each fuel pump receives electrical power from one of the three AC generator buses, and each pump in each of the fuel tanks is powered from a different electrical power source. All of the pumps were examined at the fuel pump manufacturer's facility to determine whether they were being electrically driven at the time of impact, which would provide information about the status of the electrical buses.

The fuel pump examination focused on identifying distinctive damage that would indicate whether the pumps were operating (turning) at the time of impact. Distinctive damage included gouge marks on the impeller housing, denoting contact between the housing and the rotating or stationary impeller blades, and damage to the pin-and-slot arrangement that holds the impeller to the rotating shaft. The damage showed that six pumps had high rotational energy at the time of impact, indicating that their impellers were being electrically driven.

Fuel Tank 2 left aft boost pump housing displayed distinct imprints that were caused by the impeller while it was stationary; it was determined that this impeller was not being electrically driven at the time of impact.

A determination of the operational status of the remaining pumps could not be made, as there was lack of physical damage, and therefore no definitive marks. Table 14 identifies the six fuel pumps that were determined to have been operating at the time of impact and the source of electrical power associated with each.

Table 14. Fuel pumps determined to be operating at impact

Fuel pump location	Electrical bus
Tank 1 Forward Boost Pump	115 V AC Generator Bus 1
Tank 3 Transfer Pump	115 V AC Generator Bus 1
Upper Auxiliary Right Transfer Pump	115 V AC Generator Bus 1
Tail Tank Left Transfer Pump	115 V AC Generator Bus 1
Tank 1 Aft Boost Pump	115 V AC Generator Bus 3
Tank 2 Transfer Pump	115 V AC Generator Bus 3

Both fuel dump valves were recovered and examined. The observed damage and gouge marks indicate that both valves were in the CLOSED position at the time of impact.

The auxiliary tank fill/isolation valve, and the tail tank fill/isolation valve, were recovered and examined. Impact forces captured the valve slides in both valves in the CLOSED position at the time of impact. In accordance with the known fuel system configuration and normal FSC operation, the tail tank fill/isolation valve would be expected to be closed. However, the auxiliary tank fill/isolation valve should have been open at the time of impact, unless either electrical power was not available to open it or fuel dumping had been initiated at some point. That is, during fuel dumping, the fuel system is reconfigured to close the auxiliary tank fill/isolation valve.

Only portions of the three cross-feed valves were recovered; the position of their valve slides at the time of impact could not be determined.

1.12.9 Examination of the engines

1.12.9.1 General

The three engines were examined to determine their operational status just prior to impact. Each engine is capable of producing a maximum thrust of 62 000 lb at sea level. No engine mechanical failures were discovered that could have prevented any of the three engines from operating normally.

The electronic circuit boards from the Engine 1 FADEC were recovered; however, the electrically erasable programmable read-only memory (EEPROM) chip containing the NVM had been stripped from the circuit board. As a result, no recorded FADEC information for Engine 1 was retrieved.

The FADECs from engines 2 and 3 were recovered, and information was extracted from the NVM in each of the units. These FADECs recorded 10 identical faults for the occurrence flight. Engine 2 FADEC recorded an additional 10 faults, 7 of which were duplicates of the previous 10 faults (see Section 1.12.9.3). All of the faults recorded on the FADEC NVM occurred after the aircraft had descended to approximately 10 000 feet. All of these faults were related to the loss of inputs from both of the aircraft's FCCs and ADCs, and the loss of 115 V AC and 28 V DC electrical power to the FADECs.

The disruption of 115 V AC electrical power resulted in the loss of inlet probe heat to the associated engine. Inlet probe heat is required to allow the FADEC to control engine speed in the primary EPR mode; therefore, with the loss of inlet probe heat, the engine control mode would have reverted from the primary EPR mode to the soft reversionary N₁ mode. The FADEC then establishes a down-trimmed N₁ schedule to maintain the same thrust level as prior to the reversion. A SELECT switch is provided on the FADEC control panel, which is part of the overhead panel, to allow pilots to remove the downtrim from the N₁ schedule; the engines then operate in the hard reversionary N₁ mode. The engine will respond to throttle inputs in either reversionary N₁ mode.

Faults are recorded within the FADEC in 20-minute accumulated increments and are not synchronized with aircraft FDR time. This makes it difficult to correlate any fault written to the FADEC memory with aircraft UTC time. Therefore, it was not possible to precisely correlate the FADEC faults with FDR recorded information.

1.12.9.2 Engine 1

Impact damage to Engine 1 was consistent with an engine operating at a high rotational speed and producing high power at the time of impact. Impact marks were left on the throttle shaft and throttle quadrant when the throttle fractured free of the pivot shaft. When the impact marks were aligned, the position of the throttle lever was determined to be consistent with a thrust level of approximately 45 960 lb in the EPR mode of control, or 54 195 lb in the hard reversionary N₁ mode of engine control. It is unknown whether the pilots had selected the hard reversionary N₁ schedule mode of engine control.

The metering valve in the fuel metering unit (FMU) was at or near the maximum fuel-flow position, equating to a fuel flow of between 26 900 and 28 400 lb per hour. This is consistent with a high-power setting.

1.12.9.3 Engine 2

The impact damage to Engine 2 was consistent with an engine that was rotating at a windmill speed and not producing power at the time of impact. Impact marks were left on the throttle shaft and throttle quadrant when the throttle fractured free of its pivot shaft. There were two impact marks on the throttle quadrant. When the impact mark on the throttle shaft was aligned with one of the marks on the throttle quadrant, the throttle was in a position similar to that of Engine 1. When the second mark on the quadrant was aligned, the throttle was in approximately the idle position. The damage associated with this second mark on the throttle quadrant was assessed to be the result of post-crash movement. Therefore, it is concluded that the throttle lever was in the forward position at the time of impact, even though the engine was not producing power.

Of the 10 additional fault entries recorded on the Engine 2 FADEC, 3 were related to the loss of TRA inputs to the FADEC. The TRA wiring for Engine 2 is routed from the centre pedestal, above the cockpit ceiling, and then aft through an area of known fire damage in the forward cabin drop-ceiling. The loss of TRA inputs would cause Engine 2 to revert to a fixed thrust mode, and to maintain power at the last validated throttle angle. As the FDR had stopped recording, the EPR values were not available. The last recorded thrust settings obtained from the FADEC before the engine was shut down were approximately 72 per cent N₂, or approach idle.

FADEC information indicates that Engine 2 was shut down at an altitude of about 1 800 feet^{Footnote 60}  and airspeed of 227 knots TAS. The rewriting of existing faults in the FADEC NVM can normally only occur if the engine is shut down by the selection of the FUEL switch. In the case of SR 111, the possibility of the electrical circuitry to the switch being compromised by fire damage was also considered. The wiring in the aircraft is such that selection of the FUEL switch causes two electrical circuits to become grounded, and one electrical circuit to become powered. As two of the three associated wires were in wire runs completely outside of the fire-damaged area, it is considered improbable that fire damage to the wires could have occurred coincidentally to produce this precise electrical configuration. Therefore, it was determined that the pilots purposely shut the engine down by activating the FUEL switch.

1.12.9.4 Engine 3

Impact damage to Engine 3 was consistent with an engine that was producing power above flight idle, but not at full power. Because the engine had lost the pitot heat input signal to the FADEC, the engine would have reverted to the down-trimmed N₁ mode. Impact marks were left on the throttle shaft and throttle quadrant when the throttle fractured free of its pivot shaft. When the impact marks were aligned, the position of the throttle lever was determined to be consistent with a thrust level of approximately 40 315 lb in the EPR mode. Because the engine had lost the pitot heat input signal to the FADEC, the engine would have reverted to the soft reversionary N₁ mode. Therefore, based on only the throttle position indications, the engine thrust levels would have appeared to be at a relatively high power setting.

However, the FMU provides different information. The metering valve in the FMU was determined to be at an intermediate position equating to a fuel flow of between 3 180 and 3 420 lb per hour. This fuel flow is consistent with a power setting just above flight idle. The information derived from examining the FMU provided a more accurate representation of engine status than was provided by the throttle position impact marks. Also, the physical damage to the engine is consistent with a low-to-medium power setting as indicated by the FMU setting; the analysis of the associated engine components further indicates that the engine was operating at or slightly above flight idle at the time of impact.

See the supporting technical information on this topic.

1.12.10 Examination of aircraft structural components

1.12.10.1 General

Specific structural components were identified in the main debris field from all extremities of the aircraft, from nose to tail, from left wingtip to right wingtip, and from belly to fin. A performance analysis determined that the aircraft did not accelerate to a speed that could result in aircraft structure separating prior to the time of impact, nor is there any other indication of such structural failure. There was no indication that the fire had burned through the structure, or that any of the structure had separated as a result of fire damage.

See the supporting technical information on this topic.

1.12.10.2 Empennage and wings

Pieces of the aircraft structure over 1.22 m (4 feet) long were examined for damage patterns that might help determine the attitude and configuration of the aircraft at the time of impact. These larger pieces were considered the best for providing the clearest patterns showing the deformation of the structure as a whole.

The deformation and fragmentation damage to the two horizontal stabilizers was relatively symmetrical. However, the right stabilizer displayed slightly more damage, which suggests that the right side contacted the water before the left side.

No conclusive deformation or fracture patterns were observed in any of the rudder pieces.

The deformation and fragmentation patterns of the two wings was relatively symmetrical. Therefore, it was concluded that there were no significant differences in the magnitude and orientation of the impact forces that acted upon them. Close examination of wing skin bending and torsion, stringer damage, shear clip damage, spar damage, rib damage, slat track bending, and engine pylon attachment fitting damage found subtle differences that suggested that the left wing may have sustained greater damage, and that the aircraft may have been yawed nose right at the time of impact. However, the differences were so subtle and involved such a small number of pieces that they were inconclusive. Owing to the lack of information, no determination could be made, based solely on the wing examination, about the angle of bank or pitch angle of the aircraft at the time of impact.

1.12.10.3 Cabin Outflow Valve Doors

The cabin outflow valve doors were examined to determine whether they were open or closed at the time of impact. Although there were numerous scratches, gouges, and dents on the surfaces and edges of both doors, none of these marks were continuous across both doors. This suggests that the doors were not closed when these marks were made. Additional marks made by the deformation of the door frame and the bending of the door hinges indicates that both doors were open to some degree at the time of impact.

When opening, the forward door swings outward away from the fuselage into the airstream and the aft door swings inward into the left tunnel area. Light to moderate soot was observed in areas on the exterior skin of the aft door, and light soot was observed along the hinge line of the forward door. The observed soot pattern is consistent with the doors being in an open position for a sufficient length of time to permit the doors to become sooted from the fire effluent.

1.12.10.4 Cockpit sliding clearview windows

The MD-11 is equipped with two sliding clearview cockpit windows (one on each side of the cockpit) that are normally closed and latched during flight. These windows can be opened by the pilots when in unpressurized flight; this action is part of the Swissair Smoke/Fumes Removal checklist. The structure around the clearview windows was examined to determine whether they were open, or closed and latched, at the time of impact.

The cockpit clearview windows are plug-type windows that rest against a flange around the perimeter of the sill. Each window can be moved through a crank-and-chain mechanism located on the bulkhead below the windowsill. To open the window, the locking mechanism is first released by the pilot. This preliminary action releases the latches on the aft edge of the window, but does not move the window. The initial turning of the hand crank pulls the aft edge of the window inboard enough to clear the sill, allowing the window to slide aft when the crank is further turned. The window can be unlocked when the aircraft is pressurized, but the outward force on the window is so great that turning the hand crank cannot open the window.

The damage to two of the three latch plates on the first officer's clearview window was aligned with the locked position and the damage had the same shape as the ends of the latches. This is consistent with the latches having been locked at the time of impact. The separation of the third latch plate was consistent with the direction of the damage to the first two. This damage pattern is consistent with the window having been closed and latched, and forced inboard by the impact with the water.

The damage to the three latch plates, as well as the latching mechanism, window, and sill on the captain's window, were consistent with the latches having been unlocked at the time of impact. There were also impact marks along the sill that were consistent with the pitch and location of the fasteners around the perimeter of the window. In most cases, the depth of these gouge marks penetrated both the paint and primer, and indented the metal. This is consistent with the window having been in the closed position at the time of impact.

See the supporting technical information on this topic.

1.12.11 Examination of flight crew and passenger seats

1.12.11.1 Flight crew seats

The seat belts from the captain's seat were not fastened at the time of impact, and the seat was in the egress position. The seat was broken away at the time of impact by a force having a vector component acting from right to left. There was no clear indication regarding whether the seat was occupied at the time of impact.

The first officer's seat, which had broken away from its support, was facing forward in a normal flying position, and the seat belts were fastened at the time of the impact. The seat was occupied at the time of impact.

The right observer's seat, which had broken away from its support, was facing forward in the fully aft and fully left position at the time of impact. The seat belt was unfastened. It could not be determined whether the seat was occupied at the time of impact.

Light yellow-coloured regions were found on the cockpit sheepskin seat covers. Microscopic analysis revealed that this discolouration was created by the presence of countless small tufts of light yellow fibreglass particles, which were embedded and intertwined in the grey wool fibres of the seat covers.

1.12.11.2 Passenger seats

The passenger seats sustained a high degree of impact-related damage; therefore, identification and reconstruction of individual seats was not possible. The extent of the damage also prevented any determination of whether any particular seat was occupied at the time of impact.

1.12.12 Aircraft attitude and airspeed at the time of impact

The location of the debris field in relationship to the last primary radar return shows the aircraft was in a right turn prior to the time of impact. The debris field was relatively compact and supports a relatively steep water entry. The standby attitude display showed the aircraft to be at 20 degrees nose down and 110 degrees right bank at the time of impact. The dial face on the airspeed indicator had marks, made at the time of impact, that correspond to an airspeed of 300 knots. The structural damage indicates that the aircraft had a nose-down attitude of about 20 degrees, and a right bank in excess of 60 degrees. Analysis of the markings on various wreckage pieces indicated that the impact force was from 15 degrees right of the aircraft centreline.

See the supporting technical information on this topic.

1.13 Medical information

This section summarizes the post-accident medical and pathological information of the occupants on board SR 111. Medical history information pertaining to the pilots is provided in Section 1.5, Personnel Information.

1.13.1 Recovery of occupants

The force of the aircraft's impact with the water was such that human remains were fragmented. One passenger, who was a licensed pilot, had a life vest on. For most of the other occupants, it was not possible to determine whether life vests had been donned, although it was determined that the M/C was not wearing his life vest.

The condition of the remains was also affected by the extreme post-impact environmental conditions. Within days after the accident, it became evident that human remains could only be recovered as the wreckage was recovered.

1.13.2 Identification of individuals

The identification of passengers and crew was carried out by a team consisting of the chief medical examiners of the provinces of Nova Scotia and Ontario, the RCMP, DND personnel, and others from the local medical community. One passenger was identified by visual means. The remaining 214 passengers and 14 crew members were identified through a combination of dental record comparison, fingerprint matching, forensic radiography, and deoxyribonucleic acid (DNA) protocols. All 229 occupants of the aircraft were identified by December 1998.

1.13.3 Injury patterns

All passengers and crew died instantly from a combination of the deceleration (g)^{Footnote 61} and impact forces when the aircraft struck the water. The degree of injury suggests that the longitudinal impact forces were in the order of at least 350 g. There were no signs of exposure to heat found on any of the human remains that were recovered. The injury patterns were consistent with fore and aft forces with a right lateral component of about 15 degrees, which is consistent with the information related to attitude of the aircraft at the time of impact.

1.13.4 Toxicological information

Toxicological analysis of selected specimens from the human remains was undertaken, including both SR 111 pilots, at the FAA Civil Aerospace Medical Institute to determine the presence or absence of products of combustion from the in-flight fire, in particular, carbon monoxide and hydrogen cyanide. The presence of either of these compounds in the specimens could indicate inhalation of smoke or fumes, or both, which would have assisted in providing some insight regarding the status of the cockpit and cabin environment prior to the time of impact.

None of the toxicological specimens submitted for testing were suitable for meaningful analysis of carbon monoxide. No cyanide was found in any of the specimens. This result may reflect the absence of sufficient smoke within the cabin for the cyanide compound to be absorbed in the tissues, or may reflect the unsuitability of the tissue specimens available for testing.

Both pilots were identified through DNA testing. Although carbon monoxide testing was attempted for both pilots, no useful results could be obtained because suitable toxicological specimens were not available. No cyanide was detected in either pilot. The absence of cyanide may be the result of the protection provided by the flight crew oxygen mask or other personal protective equipment, or of the unsuitability of the tissue specimens available for testing.

It is not unusual for ethanol to be detected during toxicological testing of aviation accident victim tissue specimens. Post-mortem ethanol production is the result of bacterial action and is part of the putrefaction process. The presence of ethanol depends on various factors, such as the nature and condition of the specimen; the environmental conditions to which the specimen tissues are exposed; the time duration before the specimen is recovered; and the opportunities for bacterial contamination to take place prior to, and during, the tissue recovery selection and handling process. To confirm the presence of suitable conditions for this phenomenon to occur, other specimens were tested from individuals who would not have been expected to have ingested alcohol because of age or cultural background. Of the six specimens tested, five tested positive for ethanol.

The remains of the pilots were tested for alcohol and drugs; no drugs were detected. There was no indication that either pilot ingested alcohol prior to, or during, the flight. Positive results for ethanol were obtained for both pilots; positive results can be the result of either ante-mortem ingestion or post-mortem production. Results obtained from specimens from other individuals confirmed that conditions existed for post-mortem alcohol production.

1.14 Fire 

This section describes the aviation standards in place at the time of the SR 111 occurrence with respect to flammability, fire detection and suppression, and firefighting. It also describes the nature of the fire and heat damage, as well as potential ignition sources and fuel sources.

See the supporting technical information on this topic.

1.14.1 Aircraft certification standards

1.14.1.1 Development of material flammability standards

Among the CAAs, the FAA has traditionally taken a lead role in research and development to improve fire safety in aviation. In 1988, the United States Aviation Safety Research Act mandated the FAA to conduct fundamental research related to aircraft fire safety. The FARs are used internationally as the primary source for aircraft certification requirements, including material flammability standards. Current FAA regulations reflect a philosophy adopted following a study in 1975 to 1976 to determine the feasibility of, and the trade-offs between, two basic approaches to providing fire safety improvements to a modern, wide-bodied transport aircraft fuselage. The purpose of the study was to examine the impact of in-flight, post-crash, and ramp fires on fuselage compartments, and assess the fire protection requirements.

The first approach looked at the potential of applying the latest available technologies in early-warning fire-detection and fire-extinguishing systems. This approach would involve what was described as a "fire management system"; that is, one that would incorporate fire detection, monitoring, and suppression throughout the aircraft.

The second approach looked at the potential for improving the flammability standards of materials to be used in cabin interiors so that they would have high fire-retardant qualities, and low emissions of smoke and toxic gas.

The study concluded that there were merits and limitations to each approach, and that an approach combining a fire management system with selective material improvements may offer the most potential for providing timely fire protection in all cases.

Subsequently, as recommended in the FAA's SAFER^{Footnote 62} Advisory Committee report, the FAA's main research and development efforts were directed toward what was determined to be the greatest threat: a post-crash fire. The post-crash fire scenario that was envisioned was an intact fuselage adjacent to a fire being sustained by uncontained aviation fuel. It was determined that the most significant threat to surviving passengers in such a scenario would be from burning cabin interior materials. FAA research concluded that in such a scenario, surviving passengers could become incapacitated owing to toxic gases generated by a phenomenon known as "flashover."^{Footnote 63} Therefore, to increase survivability, the FAA concentrated its efforts on improving the flammability standards for cabin interior materials to delay the onset of flashover.

In-flight fires were considered to be rare, and the FAA concluded that the best defence against them would be through the use of cabin materials that had high fire-containment and ignition-resistance properties, and through the use of fire detection and suppression devices in "potential fire zones."

Research and development related to in-flight fires has led to increased fire protection in areas such as cargo compartments and lavatories.

1.14.1.2 Material Flammability Standards - Testing Procedures

As part of the FAA aircraft certification process, materials to be used in the construction of aircraft are required to meet specified performance (test) criteria or standards when exposed to heat or flame. These flammability test criteria are designed, in principle, to expose a given material to a representative in-service fire environment. When deciding on the type and amount of testing for a particular material, assessments are made of the composition of the material, the quantity to be used, and its location within the aircraft. The testing is designed to measure the tendency of each material to ignite and propagate a flame.

For the majority of materials used in the pressure vessel, the flammability tests in place at the time the MD-11 was certified consisted primarily of a variety of Bunsen burner tests. A single Bunsen burner was used as the ignition source. Each test could be varied in several ways. For example, the orientation of the material to the flame could be varied from the horizontal through to the vertical. The orientation was specific to the test objectives, which were based on the perceived threat. The vertical burn test would normally be the most severe. Also, the length of time that the material was exposed to the flame could be varied. A longer exposure time would normally equate to a more severe test.

For each of the various Bunsen burner tests, requirements were established to differentiate between a pass or a fail for the material being tested. The following is a list of criteria that could be used to measure a material's flammability characteristics:

• Ignition time (how long it takes the material to ignite when exposed to the Bunsen burner flame; the tests typically use either 12, 15, 30, or 60 seconds of flame exposure);
• Glow time (the average time the material continues to glow after the ignition source is removed);
• Flame time (the average time the material continues to produce a flame after the ignition source is removed);
• Drip flame time (the average time that any dripped material continues to produce a flame);
• Burn length (average value for burn length measured to the nearest 0.3 cm (0.1 inches)); and
• Rate of burn (measured in inches per minute).

In accordance with individual Bunsen burner test requirements, the performance of the material was averaged over a minimum of three test specimens.

Except for selected materials in Class C cargo compartments, the most stringent material flammability standards were applied to those materials that were to be used in the occupied areas of the aircraft. Of particular interest were large surface panels, such as side walls, ceilings, stowage bins, and partitions. Not only were the materials used in the panels subjected to the most aggressive test procedures, the materials also had to be self-extinguishing; that is, they would not propagate flame beyond a certain distance, typically less than 20 cm (8 inches). Cabin materials were also subjected to tests for heat release and for smoke. No testing was required for toxicity.

See the supporting technical information on this topic.

As a consequence of the testing requirements, less stringent material flammability standards were applied to those materials that were intended for use within the pressure vessel but that were outside the occupied areas. Certain materials only required the horizontal Bunsen burner test. To pass, the material could not exceed a certain rate of burn. Depending on the intended use of the material, the rate of burn could not exceed either 6 or 10 cm (2.4 or 4 inches) per minute. No requirement existed for these materials to be self-extinguishing.

In effect, the different flammability testing requirements, as described above, resulted in the following material flammability hierarchy:

• Materials that would self-extinguish within an acceptable flame time and burn length;
• Selected cabin materials that would self-extinguish and release no more than a predetermined amount of heat and smoke; and
• Flammable materials with an acceptable rate of burn.

Therefore, many aircraft materials were certified even though they were either flammable or would burn within established performance criteria.

Many materials are installed in aircraft as part of a system, even though they are normally tested individually for flammability. For example, thermal acoustic insulation materials are typically installed as a system that includes cover material, insulation, and related components, such as splicing tape, fasteners, and breathers. However, by regulation, the testing of the "finished product" only consists of insulation and cover material together. Consequently, the "as-installed" thermal acoustic insulation materials may pose a different propensity to ignite and propagate fire than its testing would reveal.

See the supporting technical information on this topic.

1.14.2 Review of in-flight fire accident data

A TSB review of data concerning in-flight fires shows that uncontrolled fires similar to that of the occurrence aircraft are rare. The review also indicates that where an in-flight fire had developed and led to a crash, the time from detection until the aircraft crashed ranged between 5 and 35 minutes. This time frame leaves little time available to gain control of the fire. (See Section 1.16.7.2.)

In SR 111, the time between detection of the first odour in the cockpit and when the aircraft struck the water was approximately 21 minutes.

1.14.3 Designated fire zones and smoke/fire detection and suppression

The occurrence aircraft met the regulatory requirements, and was consistent with industry standards for smoke/fire detection and suppression equipment. No regulatory requirement existed for built-in smoke/fire detection or suppression devices in those areas not specified as either a designated or potential fire zone, which are referred to in this report as non-specified fire zones. Non-specified fire zones included areas such as the cockpit, cabin, galleys, electrical and electronic equipment compartment, attic spaces, areas behind side walls, and areas behind electrical panels.

Smoke/fire detection and suppression in non-specified fire zones is dependent on human intervention. However, in the MD-11 and other transport category aircraft, the airflow within the aircraft is such that air moved from some of the inaccessible areas to the occupied areas is first filtered by highly efficient aircraft ventilation and filtering systems that can effectively remove most of the combustion by-products of small fires. Therefore, a fire may ignite and propagate in an inaccessible area and its detection could be delayed.

Designated fire zones were identified as such because they were recognized as having both potential ignition sources and flammable materials. Although flammable materials existed in the non-specified fire zones, the threat of ignition was considered minimal. There was no recognized need to train aircraft crews for firefighting in other than the interior cabin areas, or to design aircraft to allow for quick and easy access to hidden non-specified fire zones for firefighting purposes.

Fire suppression in aircraft cabin areas is largely accomplished with hand-held fire extinguishers, located in such areas as the cockpit and galleys. For small, accessible fires, hand-held fire extinguishers have proven to be adequate. It has not been demonstrated that aircraft crews using hand-held fire extinguishers can be consistently effective in accessing and extinguishing fires in less accessible areas, such as attic areas or avionics compartments, also known as electrical and electronic equipment bays.

1.14.4 Time required to troubleshoot in odour/smoke situations

It can take time for odour or smoke to develop to the concentration necessary for the crew to cognitively establish that they are dealing with an abnormal situation. This can delay the initiation of checklist actions.

When the source of odour/smoke is not readily apparent, flight crews are trained to follow checklist troubleshooting procedures to eliminate the origin of the odour/smoke. Most of these procedures involve removing electrical power or isolating an environmental system. A variable amount of time is required to assess the impact of each action, typically to see whether the odour/smoke dissipates. For some checklists, including the MD-11 checklist, this procedure could take an extended period of time. The longer it takes to complete a prescribed checklist that is designed to de-energize a smoke source, the greater the chance that the smoke source could intensify or become an ignition source and start a fire.

1.14.5 Risk of remaining airborne – Emergency landing

Odour/smoke occurrences rarely develop into uncontrolled in-flight fires. At the time of the SR 111 occurrence, there was a diminished concern within the aviation industry about "minor" odours. There was an experience-based expectation that the source of such odours would be discovered quickly, and that actions could be taken to rapidly eliminate the problem.^{Footnote 64} In the operating environment at that time, operators did not have policies in place to ensure that flight crews would be expected to treat all odour and smoke events as potential serious fire threats until proven otherwise.

However, when an event that produces odour/smoke evolves into an unsuppressed in-flight fire, there is a limited amount of time to safely land the aircraft. Therefore, the decision to initiate a diversion or emergency descent or both must be made quickly to put the aircraft in a position for an emergency landing if that becomes necessary. Typically, flight crews were not required to immediately initiate a diversion to the nearest suitable airport, or to prepare the aircraft for a landing as soon as possible in the event that the situation evolves into an uncontrollable in-flight fire.

1.14.6 Integrated firefighting measures

At the time of the SR 111 occurrence, the aviation industry had not looked at in-flight firefighting in a systemic way. Typically, aircraft crews were not equipped to recognize and immediately react to signs of a potential in-flight fire. An effective firefighting plan must include procedures that include the optimum involvement of flight and cabin crew to detect, locate, access, assess, and suppress an in-flight fire in a coherent and coordinated manner. When smoke from an unknown source is detected, pilots must take immediate action to prepare for a landing as soon as possible along with other appropriate checklist actions. Such preparations optimally would involve the pilots and underscores the importance of involving other crew members in helping to deal with detection and suppression of the fire or potential fire situation.

In the event that the aircraft is at a geographical location from which a timely landing at a suitable airport is not feasible, pilots must be trained to consider alternatives, such as preparing for a potential forced landing or ditching. In such a circumstance, the capability to locate and extinguish the fire is critical. Typically, aircraft crews are not trained to implement such immediate measures.

1.14.7 Airflow patterns

Airflow patterns in the MD-11 are affected by the aircraft configuration. In the forward portion of the aircraft, this configuration includes the valve position of individual air outlets in the cockpit and throughout the cabin, and the position of the louvres in the bottom part of the cockpit door. Also, all MD-11s are equipped with a smoke barrier installed laterally across the aircraft in the attic area above the cockpit aft wall (see Figure 3). Inspection of Swissair MD-11s showed that the smoke barrier was sealed relatively tightly in some aircraft, while in others there were gaps in the barrier at the edges and at the seams where conditioned air ducts pass through the barrier. These gaps allowed air to flow past the smoke barrier. The holes in the barrier, designed to permit the engine fire shut-off cables to pass through the barrier, would also be a path for smoke to pass between the cabin and cockpit. Additional information on airflow is included in Section 1.16.3.

1.14.8 Describing the SR 111 fire-damaged area

To document and assess the heat and soot patterns created by the in-flight fire, it was necessary to identify and inspect thousands of individual pieces of wreckage and to place many of them into a reconstruction mock-up (see Figure 19). The reconstruction mock-up was designed to conform to the dimensions of the forward section of an MD-11, and comprised the area above the floor line between fuselage STA 275 and STA 595 (approximately 8.23 m (27 feet) in length).

The fire in the occurrence aircraft occurred in an area where the longitudinal (Y) axis, and vertical (Z) axis numbering is positive. The lateral (X) axis numbering is either positive (left side) or negative (right side). For simplicity in this report, the Y-axis positions will be referred to by their STA numbers. (See Section 1.6.1.3 for a description of the aircraft coordinate system.)

1.14.9 Determination of heat damage

To provide a temperature reference to assess the intensity of heat damage caused by the fire, pieces of comparable materials were intentionally exposed, under controlled conditions, to heat at various temperatures for specified time durations. The materials included pieces of the aluminum air conditioning ducts, frames, and intercostals, which were typically covered with green coloured fluid-resistant (FR) primer paint. While heating these materials, it was found that the FR primer paint incrementally changed colour when exposed to increasing temperatures, thereby making it possible to determine the approximate amount of heat exposure experienced by the fire-damaged aircraft pieces. When creating the frame temperature reference exemplar coupons, it was found that by elevating the temperature to a range of between 482°C to 593°C (900°F to 1 100°F) for 10 minutes, the FR primer paint would disappear from the surface of the exemplar piece, leaving bare metal. The temperatures shown in the figures within this report display either the temperature value of a particular representative coupon or the average value of a range of temperatures in instances where more than one coupon applies. These coupons were made based on a 10-minute exposure at a constant temperature. It is possible that exposure to higher temperatures, over a shorter time duration, may have created similar heat-damage patterns to those observed on the wreckage.

Pieces of non-metallic material, including wire insulation and electrical module blocks, were also exposed to heat under controlled conditions to produce exemplar coupons that enabled an assessment of temperatures reached by like materials from the aircraft wreckage.

The most severe heat damage to metal aircraft structure was identified by the presence in a few areas of resolidified aluminum metal that had once been molten or near-molten. The forces of impact on aluminum in a molten or near-molten state can create a signature, referred to as "broomstraw," at the edges of a fracture. High heat can also create a distinctive, layered, feather-like appearance at the edges of a fracture, referred to as "feathered edge."

By identifying and placing the various wreckage pieces into the reconstruction mock-up, it was possible to assess heat damage and soot patterns in an attempt to determine the origin of the fire and how it propagated. The heat and soot distribution information, together with other data such as the type, amount, and location of combustible materials, was entered into computer models so that the information could be integrated and the patterns more readily viewed and assessed.

Damage patterns indicate that the fire was concentrated in the areas above the cockpit ceiling liner and above the forward cabin drop-ceiling. Reconstruction of the wreckage disclosed significant heat damage on portions of the airframe structure and air conditioning system ducts in these areas, extending from approximately STA 338 to STA 675. Most of the heat damage in the cockpit was concentrated above the level of the bottom of the upper avionics CB panel (Z= 59) and in the area of the forward cabin drop-ceiling above Z= 61. The farthest forward deposits of significant soot in the cockpit were found on the standby compass near STA 313. The farthest aft soot deposits were found on an overhead stowage bin located near STA 1780.

See the supporting technical information on this topic.

1.14.10 Assessment of fire damage

1.14.10.1 Aircraft skin panels

The construction of the upper crown of the aircraft consisted primarily of 2024 aluminum alloy stressed skin exterior panels, rivetted to 7075 aluminum alloy airframe structure. The aircraft skin was painted on the outside with white exterior paint and painted on the inside with green FR primer.

There was no indication that the fire burned through the aircraft skin at any place along the fuselage, nor was there any indication of discolouration of the white exterior paint. There were varying degrees of soot accumulation on the interior surface of some of the aircraft skin panels in the area of the fire.

Forward of STA 475, insulation blankets were placed directly against the aircraft skin between the frame structure. A layer of over-frame insulation blankets was then added to cover the entire area. Between STA 475 and STA 755, no between-frame insulation blankets were installed, only the over-frame insulation blankets.

In some areas of fire damage, the lack of soot accumulation on the aircraft skin panels suggests that the insulation protected them from the fire, particularly where double layers of insulation blankets were installed. In those areas, it appeared that the between-frame insulation blankets remained in place until the aircraft struck the water.

There were two areas of predominately heavy soot accumulation on the aircraft skin, located between STA 401 and STA 420 from X= 25 to X= −25, and between STA 475 and STA 555 from X= 35 to X= −50. Between these two areas, from STA 420 to STA 475 located between X= 40 and X= −30, there was an area that had a mixture of light to moderate soot accumulation. This area is within the area above the forward passenger entry door tracks and operating cables. Another area of moderate soot accumulation was located from STA 374 to STA 401 between X= 45 to X= −25. Outside of these areas, the amount of soot on the recovered skin portions ranged from light to none.

1.14.10.2 Forward Airframe Structure Condition

Most of the airframe structural components were painted with green FR primer prior to their assembly, and were covered with insulation blankets during the aircraft construction (see Figure 4). For the inner surfaces of the frames and intercostals to become exposed to either soot or heat damage, the insulation blankets must first be compromised.

Material heat testing showed that a 10-minute exposure to temperatures below 204°C (400°F) did not discolour the FR primer; therefore, recovered structure with no discolouration of the FR primer was useful in establishing the boundary between heat-damaged and non-heat-damaged areas.

The airframe structure in the cockpit attic area with the most heat damage was forward of STA 366 between intercostal planes 15 left and 15 right (see Figure 24 and Figure 25). The intercostals appear to have created a barrier that, for the most part, impeded the fire from spreading in an outboard/downward direction. On the left side, heat damage extended outboard of intercostal plane 15, on the STA 366 frame, for approximately 10 to 15 cm (4 to 6 inches). On the right side, heat damage extended outboard of intercostal plane 15 on frame planes 10, 11, and 12 for approximately 30 cm (12 inches). This area is directly behind, and above, the upper avionics CB panel.

Between STA 366 and STA 401, the most significant heat damage pattern was along the crown of the aircraft between the plane 15 left and right intercostals. The severity of the heat damage increased toward STA 401. This area is above the cockpit centre overhead air diffuser, and immediately aft of the cockpit door.

The most forward airframe structure with heat damage resulting in bare metal was at STA 353 at X= −20, and the most rearward was on the STA 535 frame between X= 31 and X= −48. Between these two station locations, there were 17 additional frames or intercostals with similar patterns of heat damage.

The most forward area with feathered-edge damage was the STA 374 frame between X= 17 and X= −9, and the most rearward was at the STA 515 frame between X= −15 and X= −22. In the area between these two frames, 17 additional frames or intercostals showed feathered-edge damage.

Mechanical fractures with broomstraw-like appearance were found at 16 separate locations on frames and intercostals between frame STA 374 and frame STA 466. Broomstraw was also noted on the R1 passenger door forward track at approximately STA 427 between X= −29 and X= −31.

1.14.10.3 Air distribution system–Cockpit and cabin

The area of the fire damage above the ceiling in the front of the aircraft contained a network of primarily aluminum air ducts that were part of the aircraft's air distribution system (see Figure 3, Figure 8, Figure 24, Figure 26, and Figure 27). The ducts from this area were reconstructed from small pieces that were straightened, identified, fracture matched and sewn together with locking wire to replicate their original shape. Most of the aluminum ducts in the fire-damaged area were painted with FR primer prior to installation. In service, they were wrapped with thermal acoustic insulation blankets. The rebuilt air ducts provided information about the boundaries of the fire and the intensity of the heat.

Heat damage to the ducts that provided air to the cockpit ranged from no damage to heat damage resulting in bare metal. There was bare-metal heat damage starting near the top of Galley 1 and running forward to the cockpit manifold. A portion of a duct located above the cockpit door at approximately STA 396, X= 19 and Z= 72 had several resolidified aluminium deposits on the outer surface. The precise alloy of this aluminum could not be determined.

There was bare-metal heat damage on the ducts behind the cockpit air diffusers from STA 350 aft to STA 402, primarily between the plane 15 left and right intercostals. The exception was the window diffuser distribution duct, which had bare-metal heat damage along STA 392 to X= 32. The heat damage to the recovered portions of the diffusers varied, with higher heat on the upper surfaces and lower heat on the lower surfaces adjacent to the cockpit ceiling liner.

Damage to the riser duct assembly ranged from no heat damage to bare-metal heat damage. The vertical portion of this assembly had no heat damage. The first area of bare-metal damage to the riser duct assembly started at intercostal plane 15 right, where the lower surface had a region of bare-metal heat damage from X= −30 inboard to the joint at X= −20. This was in the vicinity of the Galley 2 vent end cap. There was bare-metal damage from approximately STA 395 to STA 442 between X= 25 and X= −10. A section of molded duct was installed in that area from STA 420 to STA 442 between X= 5 and X= 25. No portions of this molded duct were identified in the wreckage.

Between approximately STA 480 and STA 545, the main conditioned air ducts for zones 2, 3, and 4 transitioned from running near the top of the forward cabin drop-ceiling, upward to run near the crown of the aircraft. In this area there was bare-metal heat damage at places along the top of the ducts. The primer on the underside of these ducts was not damaged by heat. The recovered portions of two individual air ducts from approximately STA 555 to STA 595 at X= 70 and X= −70 had areas of light to moderate soot accumulation.

1.14.10.4 Air recirculation system

Recirculation air was supplied by four fans located above the passenger compartment ceiling at STAs 685, 725, 1009, and 1109 at X= 28 (see Figure 24). Each fan drew air through a filter and plenum assembly located at the corresponding station from X= 40 to X= 65. The plenum assemblies, which had been painted with FR primer on their aluminum parts, were reconstructed.

The plenums at STA 685 and STA 725 had no discolouration of the FR primer. They did have localized areas with heavy soot accumulation. The recovered portions of the fibreglass filter elements had dark grey colouration on one side and light grey colouration on the opposite side. The hoses connecting these plenum assemblies to the fan housings had localized light soot accumulation on the outer surfaces but had no soot accumulation on the interior surfaces. The recovered portions of the plenums at STA 1009 and STA 1109 had no heat damage or soot accumulation.

The recirculation duct was uninsulated between STA 569 and the recirculation fan. A check valve was installed in the duct to prevent reverse airflow when the fan was not operating. The reconstructed recirculation duct portions had been installed between the STA 685 fan and the cabin conditioned air duct, just forward of the muffler, at approximately STA 555. The duct had bare-metal heat damage on the uninsulated sections aft of STA 569.

The individual air supply to the centre section of the forward cabin was provided by two ducts, which were connected to a recirculation air duct at STA 575, X= 29 and STA 672, X= 24. Both individual air supply ducts showed bare-metal heat damage.

1.14.10.5 Left and right forward passenger cabin individual air

Forward passenger cabin individual air was supplied by a fan and plenum assembly identical to a recirculation air fan and plenum assembly. The fan was located at STA 990 at X= −24. The plenum assembly was between X= −40 and X= −65. The recovered portions of the plenum had no heat damage or soot accumulation. The individual air ducts were uninsulated and ran forward from STA 990 to a "Y" (split) at STA 750 at Z= 91, X= −21. One branch of the "Y" ran across the crown to the left side of the cabin at X= 76, and the other ran to the right side at X= −76. The recovered portions of these ducts had moderate to heavy soot accumulations on the exterior, with no heat damage. The aftermost section of individual air duct that was identified was from STA 934 to STA 955 at X= −22 and had light soot accumulation on the exterior.

1.14.10.6 Forward galleys

Galleys 1, 2, and 3 were installed forward of the first-class cabin. The outer surfaces of the top of these galleys were exposed to the forward cabin drop-ceiling area through a cut-out in the ceiling panels. Identified portions of these galleys were reconstructed to examine their exposure to the fire environment.

Galley 1, which was installed on the left side of the cabin between the cockpit aft wall and the L1 door, had heavy soot accumulation and heat damage on the top outer surface (see Figure 27). Other components of Galley 1 had varying degrees of soot accumulation, particularly near the top of the unit where it had been exposed to the fire environment. The electrical equipment in the forward upper compartment of Galley 1 did not show any fire or soot damage. Wires installed inside the galley were not affected by the fire. A four-wire harness, which was routed through an access hole in the top of the galley, had a length of white spiral wrap that had localized soot accumulation. The wires in the harness had localized light-brown discolouration.

Galley 2 was installed on the right side of the cabin between the cockpit aft wall and the R1 door. No pieces of the outer surface of the top of this galley were identified. Pieces of Galley 2 from below the forward cabin drop-ceiling were identified and did not show heat damage or soot accumulation.

Galley 3 was installed in the forward-centre position in the aircraft, immediately aft of the L1 and R1 doors between STA 470 and STA 508. There were localized areas of light soot on pieces of Galley 3 on or near the top of the unit. The portions of the wires that were installed on the upper surface of the galley top showed some soot accumulation, whereas those wires installed within the galley were free of soot. Wires associated with the Galley 3 disconnect assembly had soot accumulation ranging from trace to heavy, and showed areas of heat damage.

1.14.10.6.1 Forward galley vent system

The forward galley vent duct assembly comprised a single, uninsulated aluminum duct with branch connections to the three forward galleys (see Figure 3 and Figure 8). The upstream end of the vent duct was located above the forward cabin drop-ceiling above Galley 3. The duct ran horizontally forward above the conditioned air ducts to Galley 2, and continued laterally across the fuselage to a point above the top of Galley 1. The vent duct then ran vertically down the left side of the fuselage, outboard of Galley 1, to an area below the cabin floor. The duct continued aft under the cabin floor along the left side of the aircraft ending at the cabin air outflow valve located just forward of the left wing root. The forward galley vent system utilized a pneumatic jet pump operated by bleed air from the Pneumatic System 1. The jet pump was installed at approximately STA 872 to provide a single source of constant vacuum for the forward galleys, both in flight and on the ground. This installation provided a constant flow of between 200 and 400 CFM at the jet pump that was exhausted overboard through the outflow valve at STA 920.

From the upstream end of the forward galley vent duct, a branch duct extended vertically down to connect with the air intake grill near the top of Galley 3. A similar vertical branch extended from the vent duct toward the top of Galley 2; however, this branch was not connected to Galley 2 and the branch was closed off with a silicone elastomeric end cap (see Figure 4 and Figure 6). The vent connection to Galley 2 was not made because Galley 2 was not electrically powered, nor was an oven installed.^{Footnote 65} A ceiling-mounted air intake plenum was installed in the corridor outside the cockpit door, near the inboard edge of Galley 1. The air intake plenum was connected to the forward galley vent duct by a 8-cm (3-inch) diameter hose that was routed across the Galley 1 ceiling. This hose connected to the vertical portion of the forward galley vent duct between the left fuselage and the outboard face of Galley 1. A second hose, measuring 5 cm (2 inches) in diameter, extended from the outboard face of Galley 1 and connected to the vertical portion of the galley vent duct at STA 398, X= 48, Z= 60, just below the 8-cm (3-inch) hose. This second hose drew air (odours) from Galley 1 into the vent duct.

Two segments of the forward galley vent duct were identified; both were located on the vertical section of the vent duct that was routed between the left fuselage and the outboard face of Galley 1. The first segment was located at the cabin floor level (Z= −18); the second segment was located below the point where the 8- and 5-cm (3- and 2-inch) diameter hoses connected to the vent duct (Z= 11 to Z= 42). Both of the above-floor duct segments sustained high heat damage. Identified portions of the galley vent system from below the cabin floor, between STA 396 and STA 457, exhibited localized areas of moderate heat damage. Identified portions of the vent duct, located below the floor and aft of STA 457, exhibited no heat damage.

1.14.10.7 Forward lavatories

The Lavatory A module was installed on the left side of the aircraft forward cabin between approximately STA 465 and STA 495, immediately aft of the L1 door. A portion of the top of Lavatory A was recovered with a wire harness still attached (see Figure 27). Localized soot accumulations were noted on both the attic and cabin facing surfaces of the portions recovered. The attached wire harness was also sooted. Few additional pieces of this lavatory module were recovered and identified. Of those that were identified, there were no signs of heat damage.

The Lavatory B module was installed on the right side of the aircraft forward cabin between approximately STA 460 and STA 496, immediately aft of the R1 door. Only three pieces of this lavatory module were identified. There was soot accumulation on the cabin-facing side of these pieces, which were from the upper portion of the module. There was soot accumulation on the Lavatory B cabin placard.

There were no signs of heat damage or arcing on any of the wires associated with the forward lavatories. Light soot accumulation was noted on some of the wiring. The smoke detector control panel for these two lavatories, which was located above the forward cabin drop-ceiling over Galley 1, showed soot accumulation and heat damage.

There is no indication that either smoke alarm activated before the recorders stopped. The available information indicates that the fire did not start within one of the forward lavatories.

1.14.10.8 Cockpit and passenger cabin material

Materials from within the passenger cabin were examined for fire-related damage. One business-class seat cushion assembly, complete with seat cover, had several locations where melt-like features and discolouration were evident, consistent with the drop-down of hot materials. None of the melt-like features appeared to penetrate the underlying cushion. Sections from some fabric curtains used in the cabin had damage consistent with being exposed to heat, including discolouration, and stiffness or roughness or both. There were also areas where melted and resolidified material was adhering to the curtain fabric, including an MPET-covered insulation blanket, a blue-green material consistent with being from an electrical module block, and a material consistent with 7075 aluminum alloy. These curtains were most likely located in the aisle between lavatories A and B, and Galley 3.

Complete passenger comfort blankets and portions of these blankets were recovered. When not in use, these blankets are stored in overhead bins in the passenger cabin. Some blanket material had minor heat-related damage.

Areas of forward galley flooring and forward cabin carpet near the forward lavatories had localized areas of heat damage consistent with the drop-down of hot materials. A tiny portion of aluminum alloy that appeared to have melted and resolidified was found in a piece of forward galley flooring that had been installed along a wall. The exact type of alloy could not be identified.

One portion of cabin carpet had an area of numerous small holes through the carpet pile and backing, which were consistent with having been caused by drop-down of hot materials. This area was from approximately STA 472 to STA 505, between X= −26 and X= −46, with the highest concentration from approximately STA 482 to STA 493. This corresponds to the aisle area between Galley 3 and Lavatory B.

In the cockpit, there were numerous locations where localized heat damage had taken place. Microscopic fibre analysis confirmed that the spotted areas had been generated by fire drop-down damage. Attempts to recover traces of the drop-down material to identify it were unsuccessful, as it appears they were dislodged at the time of impact. The source for a large extent of the fire drop-down damage was most likely the cockpit ceiling liner melting and dropping down onto the carpet (see Section 1.14.10.10).

Several deposits were found on the right observer seat. Small amounts of resolidified 2024 aluminum alloy were deposited on the lap belt, and on the right side of the seat. When the resolidified metal was removed from the lap belt for analysis, a white deposit remained. Other white deposits were observed elsewhere on the same lap belt. Trace analysis of these deposits disclosed that they were primarily aluminum oxide, and microscopic fibre analysis revealed fused heat damage material at each location. The white deposits were determined to be the remnants of other locations where resolidified aluminum had also been deposited. It was not possible to determine the alloy of the aluminum from the remnants. A small amount of resolidified 6061 aluminium alloy was found on the rear of the right observer seat base.

Two cockpit checklist booklets were recovered with the aircraft wreckage. Both were heat damaged. In these checklists, each double-sided page is contained in a plastic sleeve, and the pages are bound together along one edge. Each sleeve can be rotated about its bound edge and turned over and under the booklet so that one page is visible on one side of the booklet and the next page in the sequence is visible on the other side of the booklet.

One of the booklets had more heat-related damage than the other. Some of the edges of the plastic sleeves had been partially melted and fused together, fixing the booklet in the open position to pages 10 and 11. Page 10 was the Smoke/Fumes of Unknown Origin checklist, and Page 11 was the Smoke/Fumes Removal checklist. Page 11 was more significantly heat damaged than Page 10. The heat pattern appeared to be from the outside surface inward, suggesting the booklet was in a horizontal position with Page 11 upward at the time it was heated. On the second checklist booklet, a small burn mark was found at the top edge of Page 1 (Index) and extended through to Page 4 (ENG 2 A-ICE DUCT). Two mating heat-related damage marks were found on Page 2 (INTENTIONALLY LEFT BLANK) and on Page 3 (ENGINE–FIRE).

1.14.10.9 Cabin ceiling panels

Ceiling panels were used to separate the passenger space from the attic area throughout the cabin portion of the aircraft. The panels were suspended from the structure of the aircraft fuselage using suspension rods, beams, and attachment hardware. All the panels were manufactured as phenolic/glass skins, bonded to meta-aramid fibre paper honeycomb-like core. Some of the panels had white bondable PVF adhered to one side only and some showed it on both sides. A decorative PVF laminate was adhered to the face of the panels that were visible from the passenger compartment.

Three types of ceiling panels were used to construct the passenger cabin ceiling and another four types were used to construct the forward cabin drop-ceiling. Of these four, the CD 207 type panel was used to construct portions of the overhead bins and the two sliding ceiling panel assemblies at the forward doors. Similar types of panel construction were used to fabricate the close-out panels, forward cabin drop-ceiling, header panels and bridge/gap assembly panels.

Portions of the various panels were recovered and examined for soot and heat damage. As ceiling panels had been fractured into many pieces by impact forces, their installed locations in the aircraft could not be positively identified. Of the recovered pieces, many showed signs of heat damage or soot accumulation or both. The heat damage varied from discolouration to severe charring of the panel core. Most of the heat damage was on the attic side of the panels but some displayed heat damage on the cabin side as well. This could be considered an indication that the fire had penetrated the ceiling in these areas.

Some of the panels could be identified as to type by their construction. One piece of CD 207 panel was determined to be either a portion from one of the sliding forward door panel assemblies in the forward cabin drop-ceiling area or a panel portion from one of the overhead stowage bins in the first-class cabin. The damage to this piece was consistent with exposure to a temperature of 593°C (1 100°F) for 10 minutes. Four recovered pieces were identified as portions of bridge/gap cover assemblies in which the aisle and emergency lights were installed. These portions had areas of dark-brown discolouration in the shape of a half moon, which coincided with the installation location of the aisle and emergency lights. Another four of the recovered pieces were determined to be portions of the overhead stowage bins. Three of these portions showed no indication of heat damage. The fourth portion, identified as part of an overhead stowage bin ramp air duct, showed a soot pattern similar to that deposited on an adjacent panel.

1.14.10.10 Cockpit ceiling liner and dome light

Cockpit ceiling liners, constructed of a light grey thermoformable^{Footnote 66} low-heat-release sheet material, are installed as the interior finish surface of the flight compartment. The material has a low forming temperature; that is, it melts within a relatively low temperature range. It begins to soften and sag at 246°C to 274°C (475°F to 525°F). The five sections that comprise the cockpit ceiling liner are attached to the aircraft structure with screws and nutplates.

The overhead liner is installed immediately aft of the overhead CB panel (see Figure 9 and Figure 10). The liner includes the cockpit dome light assembly and has openings for the air conditioning system diffusers and diffuser controls. Some of the dome light components displayed light soot deposits; the identified portions of the dome light assembly showed a few signs of heat damage. Only a small number of pieces of the centre overhead liner were identified. Heat damage on the fuselage-facing surface of the pieces was indicated by a dark brown to black discolouration. The cockpit-facing surface of the pieces had localized heat damage indicated by hints of taupe discoloration. The heat also caused thinning, necking, surface melting, and wrinkling of the material. The surfaces showed localized light to moderate soot, wrinkles, bubbles, and edge melting.

The left and centre-left liners enclose the area bound by the left edge of the overhead switch panel housing, aft to the ceiling panel and then bordered the dome light and left diffuser outlet aft to the cockpit coat closet. The lower edge of the liners follow the top of the clearview and aft windows back to the cockpit coat closet. The left liner has cut-outs to accommodate two air conditioning slide controls, individual air supply, captain's map light and speaker control box, observer's map light and on/off dimmer control, audio and microphone jack panels and three inspection panels. The cut-out for the captain's map light and speaker control box is located in the forward lower corner of the left liner. The left liner also incorporates an escape rope compartment door, located adjacent to the captain's air conditioning slide control. The centre-left liner has cut-outs for the spare lamps compartment door and an individual air supply.

The majority of the left liner was identified and reconstructed. The fuselage-facing surface of the liner had heavy soot deposits over most of the surface, along with heat damage. The heat damage varied from dark brown to black discolouration with localized small wrinkles and surface melting. The cockpit-facing surface had moderate to heavy soot deposits from the forward to the aft end of the liner, with localized areas exhibiting surface wrinkles caused by heat. The microphone/headset hook, located approximately one third of the way from the front of the liner, displayed moderate soot accumulation on the surface. A piece of the escape rope compartment door had no heat damage. The only piece of the centre-left liner that was identified was a small portion of the spare lamps compartment door that had remained attached to its hinge assembly. The cockpit-facing surface had melting and bubbling with dark brown and black discolouration. The surface that faced into the Spare Lamps compartment had localized light soot deposits.

The right and right aft liners enclose the area between the right edge of the overhead switch panel housing, the upper avionics CB panel, lower avionics CB panel, and the cockpit video monitor. The lower edge of the liners follow the top of the clearview and aft windows back to the video monitor. The right liner has cut-outs to accommodate the air conditioning slide control, individual air supply, first officer's map light and speaker control box and, audio and microphone jack panel. The cut-out for the first officer's map light and speaker control box is located in the forward lower corner of the right liner. The right liner also incorporates an escape rope compartment door, located adjacent to the first officer's air conditioning slide control.

The majority of the right and right aft liners were identified and reconstructed. The fuselage-facing surface of the right liner had light accumulations of soot, along with several areas of heat damage. The heat damage varied from light to dark-brown discolouration near the microphone hook, to black discolouration with blisters and surface melting near the overhead CB panel. The cockpit-facing surface had localized areas of light soot accumulation. The heat discolouration varied from dark grey, to dark grey with light taupe in localized areas. There was slight blistering of the surface. The right aft liner displayed light soot only, with no heat damage.

1.14.10.11 Avionics circuit breaker panel

The avionics CB panel consisted of upper and lower panels, located above the work table at the right observer's station (see Figure 12). The main body of each panel was constructed of aluminum. The upper avionics CB panel had five rows of CBs, identified alphabetically from A to E. Individual CBs were numbered sequentially, starting from the left, and were identified according to the row in which they were installed (e.g., CB D1). The lower avionics CB panel had one row of CBs, identified as Row F. The front (inboard) face of both the upper and lower avionics CB panels was painted grey, and the back (outboard) face was not painted.

About 75 per cent of the upper and lower CB panels were identified, reconstructed, and placed in the reconstruction mock-up (see Figure 27 and Figure 28). The most forward sections of the upper and lower CB panels were not recovered. The upper avionics CB panel had been exposed to heat coming from both the front and back sides. The lower CB panel did not show any heat damage. The heat damage pattern on the front face of the upper CB panel was shown by the change in colour of the paint. Parts of the panel displayed damage consistent with temperature reference exemplar coupons exposed to temperatures from 430°C to 620°C (800°F to 1 150°F) for 10 minutes.^{Footnote 67} Discolouration and heat damage was present on the back side of this panel on some electrical components and on some bare-metal surfaces. Although there were similarities at some locations, the damage pattern on the back side was less than on the front side, particularly on those pieces near the forward end of the panel where the front side of the panel showed considerably more heat damage than the back side. Individual CBs showed soot on the white indicator ring; soot could only have been deposited if the CB had tripped and subsequently been exposed to combustion by-products. Details concerning the CBs on the avionics CB panel and wiring in the vicinity are included in separate sections of this report.

It was noted that the heat damage on parts of the upper avionics CB panel was consistent with damage seen on temperature reference coupons that were exposed to temperatures from 427°C to 620°C (800°F to 1 150°F) for 10 minutes.^{Footnote 68}

1.14.10.12 Overhead circuit breaker panel

The overhead CB panel is located just aft of the overhead switch panel in the cockpit ceiling, above and behind the captain's and first officer's seats (see Figure 12). The panel has seven rows of CBs identified alphabetically from A to G. Like the avionics CB panel, individual CBs are numbered sequentially, starting from the left, and are identified according to the row in which they were installed (e.g., CB A1). An integrally illuminated, polycarbonate lightplate base assembly was installed on each row of CBs.

Most of the CB panel was identified, reconstructed, and placed in the reconstruction mock-up (see Figure 27 and Figure 29). On the cockpit-facing surface, approximately two thirds of the polycarbonate lightplate base on Row A had been melted and folded back over onto itself, forming a fused mass of material near the top right corner of the panel. Part of the right end of the lightplate base on Row B was also melted and fused into this mass. The top right corner of the panel where the paint was missing had heat damage consistent with temperature reference coupons that were exposed to temperatures from 427°C to 621°C (800°F to 1 150°F) for 10 minutes, and the area where the paint was discoloured had heat damage consistent with temperature reference coupons that were exposed to temperatures from 343°C to 398°C (650°F to 750°F) for 10 minutes. The rear surface of the panel also showed signs of localized high-heat damage at the top right corner.

Individual CBs showed soot on the white indicator ring. Soot could have been deposited if the CB had tripped and subsequently been exposed to the smoke environment.

1.14.10.13 Heat and fire damage pattern–Aircraft wires and cables

All of the wire segments identified as being from the heat-damaged section of the aircraft were compared to exemplar wires before being incorporated into the reconstruction mock-up. The exemplar wires were created by heating them at specific temperatures for specific times in a controlled heat environment. When the exemplar wires were heated, it was observed that the ETFE wires were more susceptible to heat than the polyimide wires. This was consistent with the damage observed on the wire segments that were recovered. The examination of the wire segments from the heat-damaged area helped define the heat pattern and boundaries of the fire. There were wires from the area of the fire that had no discernible damage. There was a range of damage on other wires, from light soot, to complete melting and destruction of the wire insulation.

The wires that were routed between the upper avionics CB panel and the avionics disconnect panel had areas of localized soot accumulation, and some minor heat damage. The bus feed wires that were routed between the upper avionics CB panel and the upper main CB panel had some areas of localized light soot accumulation, and some minor heat damage, near the upper avionics CB panel. The ETFE wiring that was routed above this area, closer to the aircraft structure, showed more pronounced heat damage.

The IFEN-related PTFE 8 AWG jumper wires from the forward end of the lower avionics CB panel were not heat damaged. Polyimide wires in the same area near the lower avionics CB panel showed soot accumulation, but no heat damage. Based on the appearance of the surrounding area, it was considered likely that the IFEN-related 8 AWG and 12 AWG wires that were routed from the aft end of the lower avionics CB panel upward toward the bottom of the avionics disconnect panel had little heat damage. The portions of these wires that were located near the ceiling structure area, including where the 12 AWG IFEN wires entered the conduit, were heat damaged.

See the supporting technical information on this topic.

1.14.11 Potential ignition sources

1.14.11.1 General

The wreckage reconstruction mock-up helped delineate the boundaries of the fire damage, which were primarily located in the cockpit attic and forward cabin drop-ceiling areas. Within the primary fire-damaged area, the most prevalent potential ignition source was electrical energy. Numerous power cables and wires were present in this area, running to or from either the avionics compartment, the cockpit CB panels, or the overhead switch panels. There were also numerous other electrical components, such as module blocks, ground studs, light fixtures, battery packs, two electrically powered galleys, two lavatories, and electrically powered door mechanisms. Consideration was given to other ignition mechanisms, such as chemical reactions, thermal processes (e.g., conduction, convection, radiation) and mechanical operations (e.g., friction) but none were found. Only those related to electrical energy were assessed as being pertinent.

Each of the 20 wire or cable segments exhibiting arc damage was assessed for potential involvement as an ignition source. Several criteria were taken into account when making this assessment, such as information from the CVR about the cockpit and passenger cabin environment, the time frame between when the odour was first noted and when the fire first affected aircraft systems, the presence and proximity and quantity of flammable materials, the fire damage pattern, and the airflow patterns in the aircraft as determined through flight testing and research.

The initial odour and smoke were noticed only in the cockpit, and the pilots assessed it to be from an air conditioning source. The actions by the pilots, and the airflow patterns in the cockpit area, suggest that the smoke was most evident at or near the cockpit rear wall. (For additional airflow information, see Section 1.16.3.)

1.14.11.2 Positioning of the IFEN power supply cable segments exhibiting arcing events

When the four IFEN PSU cable segments that exhibited melted copper were positioned parallel to one another, similarities were noticed that suggested that there were two matching pairs of cable segments (see Figure 22 and Section 1.12.3.6). Exhibits 1-3791 and 1-3793 were almost identical in length and colouration, as were 1-3790 and 1-3792.

Once the two pairs were matched together, there were notable differences that distinguished one pair from the other. The 1-3790/1-3792 cable pair was about 18 cm (7 inches) shorter than the 1-3791/1-3793 pair, and starting at about 61 cm (24 inches) from the straightened-out end the 1-3790/1-3792 pair had an almost identical span of approximately 30 cm (12 inches) where the tin coating was completely missing. Over the last 5 cm (2 inches), the tin was again present. The 30-cm (12-inch) region of missing tin was the result of exposure to a localized temperature that was higher than the temperature experienced in the area where the tin remained intact.

Exhibit 1-3790 had copper melt on a single wire 11 cm (4.3 inches) from its end, and additional copper melt on all three wires between 62 and 77 cm (24.3 and 30.5 inches) from their respective ends. Exhibit 1-3792 had copper melt on one wire at 22 cm (8.8 inches), and on a second wire at two locations: 22.6 cm (8.9 inches) and 23.4 cm (9.2 inches) from its end position. The second wire was severed between the two copper melts.

Cable 1-3791 had copper melt on one wire 9 cm (3.7 inches) from its end and at the 62-cm (24.5-inch) location. A second wire also had a copper melt at the 65-cm (25.8-inch) location. Cable 1-3793 exhibited melted copper on one single wire between 64 to 67 cm (25 to 26.5 inches) from its end.

The two pairs of cable segments could not be co-located by aligning all of them to either one end or the other, because the region of missing tin on the 1-3790/1-3792 pair was not duplicated on the 1-3791/1-3793 pair. As the cables had been installed as a contiguous bundle, it is not possible for only two of the four cables to be affected by a localized higher temperature.

Based on the presence of FEP remnants trapped in the wire strands, the PSU cable pairs were considered to have been either in, or in close proximity to, the conduit located above Galley 2. The recovered segments of wire runs FBC and FDC, which had been routed parallel to the conduit in the area over Galley 2, were positively relocated in the aircraft based on the installed position of the marriage clamp at approximately STA 427. It was noted that from approximately 30 cm (12 inches) aft and forward of the clamp along the FDC wire run, and for approximately 30 cm (12 inches) forward of the clamp along the FBC wire run, there was a region that appeared to have been subjected to a higher temperature than the remaining wires in the harness, similar to the region of missing tin on the 1-3790/1-3792 pair of cables. On both sides of the dual clamp, the polyimide film insulation remaining on the FBC and FDC wires was blackened, similar to test samples that had been exposed to a temperature of about 500°C (932°F) for 10 minutes.

A 38-cm (15-inch) segment of IFEN PSU cable with a 30-cm (12-inch) section of tin missing from all three wires was recovered and designated as Exhibit 1-4687. This cable segment was considered to have been from the area near the FBC/FDC clamp, and to be a continuation of either Exhibit 1-3791 or 1-3793. The location on Exhibit 1-4687, where there was a transition between tin and missing tin, was aligned at the aft end of the conduit such that it matched the start of the missing tin on the 1-3790/1-3792 pair. When the three cables were placed with their regions of missing tin aligned, it was noted that the individual wires within the region of missing tin were similarly embrittled. Furthermore, two of the cable segments, exhibits 1-3790 and 1-4687, had nearly identical twists in individual wires that were adjacent to each other in this alignment. The frayed (aft) end of Exhibit 1-3791 closely matched in colour the end of Exhibit 1-4687 where the tin was not missing. The lengths of the fractured ends were of similar lengths, suggesting that they could have been joined at one time. Based on this similarity, Exhibit 1-4687 was considered to be a continuation of Exhibit 1-3791. When the area of missing tin on the 1-3790/1-3792 pair and 1-4687 was aligned on either side of the clamp, and taking into account the known routing of the cables as they exited the conduit, the beginning of the missing tin was placed at approximately the aft end of either the middle or outboard conduit, or possibly just inside the conduit by less than 2.5 cm (1 inch).

Aligning the cables in the outboard conduit using the same criteria as above for placing the region of missing tin placed the single arc on 1-3790 near STA 410 and the remaining (aft) melted copper locations on all three wires from Exhibit 1-3790 approximately 25 cm (10 inches) along the wires aft of STA 420. This placed the copper melts on two of the wires from Exhibit 1-3791 adjacent to the copper melts on the single wire of Exhibit 1-3793 near STA 401. This also located the single copper melt on the forward end of Exhibit 1-3791 approximately 8 cm (3 inches) along the wire forward of the bracket at STA 383. This configuration is shown in Figure 30.

Aligning the cables in the middle conduit, the single (forward) melted copper on Exhibit 1-3790 was located near STA 407 inside the conduit, and the remaining (aft) melted copper locations on all three wires from Exhibit 1-3790 were about 7.5 cm (3 inches) outside the aft end of the conduit. In this configuration, the remaining areas of melted copper on Exhibit 1-3792 were in the conduit between STA 407 and STA 408. In this alignment, it placed the forward end of the 1-3791/1-3793 cables approximately 25 cm (10 inches) along the wire path past the bracket at STA 383. This placed the copper melts on two of the wires from Exhibit 1-3791 adjacent to the copper melts on the single wire of Exhibit 1-3793 near STA 398. This also located the single copper melt on the forward end of Exhibit 1-3791 approximately 15 cm (6 inches) along the wire path outside of the forward end of the conduit. This configuration is shown in Figure 31.

The arced ends of the four 16 AWG control wires (1-3788, 1-3794, 1-3795, and 1-10503) could have been the result of two arcing events severing the wires. The arced ends of exhibits 1-3795 and 1-10503 were a possible match, based on the similarity of the missing tin over a short distance from each of their arced ends. Assuming the arced ends of 1-3788 and 1-10503 were also a match, and laying out the four segments as one continuous wire, their overall length was within a few centimetres of that of the 12 AWG 1-3790/1-3792 pair. Laying the combined 16 AWG control wire alongside the 1-3790/1-3792 pair also showed that their arc locations could be co-aligned, indicating they may have been caused at the same time. However, Exhibit 1-3795 was not missing tin over the same length as the 1-3790/1-3792 pair; this made it less likely that they could be co-aligned.

The regions of melted copper on the 1-3791/1-3793 pair were co-located, suggesting that the arcing events that produced the copper melts occurred at approximately the same time, or within seconds of each other. All of these arcs occurred where the cables would have been running through the conduit, suggesting phase-to-phase arcing occurred when the fire destroyed the conduit and wire insulation.

The one anomaly is the copper melt on a single wire near the forward end of Exhibit 1-3791. This same wire also exhibited melted copper approximately 51 cm (20 inches) further aft, within the conduit. The melted copper in two locations indicates that one of the arcing events did not trip the associated CB. The arcing events in the conduit had the appearance of being more severe, and it is believed that they would have tripped the CB. Therefore, the forward arc event on Exhibit 1-3791 must have occurred first, as electrical power would not be available to produce the forward arcing if the arcing in the conduit had occurred first and tripped the CB.

The melted copper on the 1-3790/1-3792 pair within the conduit also appears to be the result of the fire destroying the conduit and wire insulation. This allowed arcing to take place between phases, and also with the 16 AWG control wire. In the placement of the 1-3790/1-3792 pair, as described above, the single (forward) arc on Exhibit 1-3790 did not align exactly with the melted copper on Exhibit 1-3792 inside the conduit. The initial alignment resulted in an approximate 5-cm (2-inch) separation between these arcs.

As the single (forward) arc on Exhibit 1-3790 occurred inside the conduit, it had to have arced to either another IFEN PSU cable, or the 16 AWG control wire. Therefore, the original positioning of the 1-3790/1-3792 pair of cables had to be adjusted slightly (within the 5-cm (2-inch) range) to align all of the copper melts. As with Exhibit 1-3791, the fact that a single arc event took place on one wire that subsequently arced approximately 51 cm (20 inches) farther aft indicated that the initial arcing event did not trip the CB. The arcing on Exhibit 1-3790 that occurred outside the aft end of the conduit involved all three phases. This would have tripped the CB, indicating that the forward arc occurred first and did not trip the CB.

Various combinations were tried to determine the best placing for the arc-damaged IFEN PSU cable and 16 AWG wires segments, particularly with respect to their positioning in relation to the localized heat zone noted on either side of the two clamps. However, all of the combinations had to take into account the regions of missing tin on the 1-3790/1-3792 pair of PSU cables. For the various layouts, this region of missing tin was always matched to the area of the two clamps on FBC and FDC, as this was a known location from which to start. No other combination or layout could be supported by the physical evidence on the cables and wires.

As indicated above, based on the layout of the cables and wires, it is possible to assess the direction of fire propagation based on the sequence of the arcing events. The aft arcs on exhibits 1-3790 and 1-3791 would most likely have tripped their associated CBs; therefore, the forward arcs must have occurred first, and not tripped their associated CBs. This strongly suggests that the fire was moving forward to aft.

The region of missing tin represented an area of higher heat. If this had been an earlier event, it is strongly suspected that all three cables would exhibit similar arcing events in the vicinity of 1-3790 outside the aft end of the conduit. With the cables and control wire laid out as described above, all of the regions of melted copper could be attributed to arcing events between phases on the same cable, between the cables and the control wire except for the arc event that took place at the forward end of 1-3791, or both. There was no matching arc damage on cable 1-3793 in this area. However, the continuation of exhibits 1-3790/1-3792 from approximately STA 401, along with the 16 AWG control wire forward, were not identified. Therefore, no determination could be made with respect to exactly what the single wire from 1-3791 had come in contact with at the forward end.

1.14.11.3 Three identified arced wires from aircraft systems

The three exhibit numbers discussed in this section are 1-3029, 1-1733, and 1-12755.

Of the three identified arced wires from aircraft systems, two were accurately placed such that the arcs were located about 15 cm (6 inches) aft of the right oval hole in the overhead switch panel housing. (See Figure 23.) The arc on the third wire was located in the same general area. From a potential arcing perspective, this area is considered benign in that the wires, as installed, have little likelihood of being chafed or otherwise damaged. However, there are MPET-covered insulation blankets in close proximity to the wires. The three wires were assessed regarding their potential to be related to the lead ignition event.

Exhibit 1-3029 is a section of 10 AWG tin-coated, XL-ETFE (BXS7008) insulated wire from the left emergency AC bus feed cable. The area of melted copper was approximately 15 cm (6 inches) outside of the right oval hole in the overhead switch panel housing. The functions powered by the left emergency AC bus were lost at 1:25:06. The arc on this wire would have tripped the left emergency AC bus remote controlled CB. If this arcing was connected to the lead event, the loss of this bus would have been obvious to the pilots, and the loss of associated systems would have been recorded on the FDR much earlier than when they were actually recorded. The arc on this wire was the result of fire damage, and was not connected to the lead ignition event.

Exhibit 1-1733 is a section of 24 AWG nickel-coated, polyimide-insulated wire from the Engine 2 fire detection loop "A" circuit. The wire was severed by an arc event at one end. The area of melted copper occurred about 15 cm (6 inches) outside the right oval hole in the overhead switch panel housing. The arc on this wire would have caused the Engine 2 fire detection loop "A" circuit to open, or the associated CB to trip, causing loop "A" to be de-powered. The fire detection control unit would then send a fault to the DEU, which would be displayed to the crew as a Level 1 (amber) "FIRE DET 2 FAULT" alert on the EAD. A fire alarm would not be generated, nor would an overhead warning light illuminate. There was no mention by the crew on the CVR of any alerts being displayed before the smoke appeared in the cockpit. This arcing event most likely occurred as a result of fire-related damage to the wire, and was not likely connected to the lead ignition event.

Exhibit 1-12755 is a section of 22 AWG nickel-coated, polyimide-insulated wire from the high-intensity lights (supplemental recognition) wingtip strobe lights circuit. The high-intensity wingtip strobe lights are turned on in the cockpit by the HI-INT push button located in the overhead light switch panel. When the lights are off, the button illuminates a blue OFF legend. This wire is powered when the lights are on. The loss of power to the wire will result in the high-intensity lights shutting off, but the OFF legend in the switch will not illuminate as long as it is in the ON position and the left ground sensing relay R2-5009 is powered. Therefore, a shorting of this wire would be a hidden event for the crew unless a CB tripped and was noted.

Exhibit 1-12755 was severed by an arcing event at one end. In the reconstruction mock-up, the location of the wire could not be precisely determined; however, it had been installed in the wire run between the forward switch panel receptacle R5-204 in the overhead switch panel housing and the electrical connector plug P1-420 in the overhead disconnect panel. There is no indication that any wire arcing occurred within the overhead switch panel housing; therefore, the arc on this wire likely occurred between the overhead switch panel housing and the disconnect panel, most likely at about 15 cm (6 inches) outside the right oval hole in the same location as the other known fire-related arcing in that area. This suggests that the arcing event occurred as a result of fire-related damage, and was not connected to the lead ignition event.

1.14.11.4 Nine arced wires–Locations not determined

The nine exhibit numbers discussed in this section are 1-3700, 1-3713, 1-3718, 1-3796, 1-4689, 1-11252, 1-11897, 1-12756, and 1-12809.

The exact installed location and system function of each of the nine arced wires could not be determined. It is highly unlikely that all nine wires arced at the same location and time.

1.14.11.4.1 Exhibits 1-4689 and 1-11897

Exhibits 1-4689 and 1-11897 were identified as sections of 10 AWG tin-coated wire, with the insulation missing. Based on the tin coating, it is likely these two sections were insulated with MIL-W-22759 type insulation. The left emergency AC bus displayed arcing damage; this wire was 10 AWG tin-coated, with MIL-W-22759/34 type insulation. It is also known that power to this bus feed was lost at 0125:06, when numerous functions powered by this bus were simultaneously lost.

Loss of the left emergency AC bus would result in the left emergency DC bus being powered by the aircraft battery, and the left emergency AC bus being powered through a static inverter also powered by the battery. Although the left emergency AC remote control CB (RCCB) most likely tripped as a result of the arcing event at 0125:06, there is no CB protection for the left emergency AC bus when powered from the static inverter. The current is limited only by the inverter itself; therefore, electrical power would continue to be fed to any short-circuit until the inverter itself failed. Therefore, it is possible that exhibits 1-4689 and 1-11897 could be from the left emergency AC bus feed.

Other 10 AWG wires routed within the fire-damaged area were also assessed. Three systems or components were powered by 10 AWG wires. One 10 AWG wire was installed completely within the overhead switch panel housing, where it is unlikely that any arcing took place. The remaining two 10 AWG circuits were associated with the tail tank alternate fuel pump and the Tank 2 left aft fuel pump. Both of these three-phase power circuit wires were routed through the right side of the forward cabin drop-ceiling.

Of these two pumps, only the Tank 2 left aft pump would have been powered at the time of the initial odour. According to the wiring diagram for this circuit, the three 10 AWG wires, C104-147(148) (149)-10, were routed between STA 475 aft to STA 1059. Also, according to the Boeing conduit list, the 10 AWG Tank 2 left aft fuel pump wires were polyimide insulated and nickel coated, not tin coated. As the most forward location for these wires was STA 475, they were considered to have been located too far aft to have been involved as a potential source of ignition.

1.14.11.4.2 Remaining unidentified exhibits

Exhibit 1-11252 was a section of 24 AWG nickel-coated, polyimide-insulated wire. The physical appearance of Exhibit 1-11252 was almost identical to Exhibit 1-1733 (a segment of the Engine 2 fire detection loop "A" circuit) and could be a matching end, and as such a continuation of that wire.

Exhibits 1-3700 and 1-3718 were sections of 20 AWG nickel-coated, polyimide-insulated wires, and exhibits 1-3713 and 1-12809 (see Figure 20 for a photograph of 1-12809) were sections of 24 AWG nickel-coated, polyimide-insulated wires. These wires could not be associated with any particular circuit or system. During the final 92 seconds of the FDR operation, numerous systems anomalies were recorded. Two of the recorded anomalies were related to systems that were powered by 20 AWG wires, and six were related to 24 AWG wires. Any of these anomalies could have resulted from either an arc or from thermal tripping of the system CB.

Exhibit 1-12756 was identified as a section of 18 AWG tin-coated, polyimide-film-insulated wire. This wire was unusual in that nickel-coated, polyimide-film-insulated wire was the standard used during the manufacture of the aircraft. Exhibit 1-12756 could be related to a modification made to the aircraft following manufacture, but it could not be positively identified. As this wire could not be placed in the reconstruction mock-up, its potential involvement in the lead event could not be assessed from a systems perspective.

Exhibit 1-3796 was recovered as part of the bundle of entangled wires (Exhibit 1-4372) that contained the arced IFEN PSU cable segments, suggesting that it may have been installed in the same area of the aircraft. It was determined that these PSU cable segments had been installed above Galley 2 (see Section 1.12.3.4), starting in the vicinity of the cut-out in the top of the cockpit rear wall and running aft to about STA 420. Exhibit 1-3796 was assessed for its potential to be involved with the lead arcing event.

The area between the cut-out in the top of the cockpit rear wall aft to STA 420 (above Galley 2) was inspected on all of Swissair's fleet of MD-11s for potential anomalies that could lead to arcing. The wire bundles and conduits run relatively straight in that area, and the area is not considered to be susceptible to damage from routine maintenance operations or contamination. The threat from mechanical wire chafing in that area was considered to be low. During the inspections, no potential anomalies that could lead to arcing were found.

To create the 2-cm copper melt on Exhibit 1-3796 would require a significant arc-tracking event. Such an arc-tracking event would almost certainly have involved at least one other wire arcing, and would have resulted in significant damage to a number of adjacent wires. Significant collateral damage to nearby wiring is often seen when similar arc tracking occurs in laboratory testing, and may account for some of the other arced wires that were found but not positively identified as to location or circuit function.

Exhibit 1-3796 was also assessed for its potential to be connected to a lead arcing event in the area forward of the cut-out in the top of the cockpit rear wall, behind the avionics CB panel. Such a scenario is considered unlikely for the following reasons. In laboratory testing, similar arcing events are known to produce a series of loud snapping-type sounds. These loud snapping sounds are typically accompanied by brilliant flashes of light similar to arc welding. In the MD-11, such flashes could potentially be seen in the (darkened) night cockpit lighting conditions through the small openings around the CB panel, or around the edges of unused CB holes. It is unlikely that the type of arcing event that produced Exhibit 1-3796 could be mistaken by the pilots as an air conditioning anomaly if it occurred behind the avionics CB panel. If this type of arcing event occurred behind the avionics CB panel, it would be expected that the arcing would produce significant damage to adjacent wiring. During such an event, it is most likely that one or more systems alert messages would appear, anomalies would be recorded on the FDR, or CBs would trip. Again, no such anomalies were mentioned by the pilots or recorded on the FDR for some 13 minutes.

1.14.11.5 Hella map lights

The first officer's and the right observer's map lights were recovered, examined, and ruled out as potential sources of ignition for the fire. The captain's and the left observer's map lights were not found in the recovered wreckage. The map light fixture installed at the left observer's position did not have any history of electrical anomalies similar to the Hella map lights, and it was ruled out as a potential ignition source.

The Hella map light in close proximity to the MPET cover material at the captain's map light position presented a potential lead ignition-event scenario. Airflow flight testing showed that some of the test smoke generated above the cockpit ceiling at the captain's map light position would enter the cockpit around the left window air diffusers. It would almost certainly enter from one or more other locations also, including the map light housing, the left-side window diffuser slide control, and the engine fire handles.

If the fire started immediately overhead of the captain, it would be expected that he would detect the odour first; it appears that this was not the case. Also, if the initial smoke was coming from the area of the map light, it would not have been necessary for the first officer to stand to inspect the suspected area. Smoke entering through openings remote from the diffusers, especially through the map light housing itself, would be less likely to be mistaken for air conditioning smoke. Furthermore, a lead ignition event this far forward in the aircraft would not lead to the substantial fire-related damage that occurred in the attic area of the forward passenger cabin in the known time frame of the fire. The available information indicates that the fire did not start in any of the map lights.

1.14.11.6 Inside the overhead switch panel housing

The examination of the recovered material from inside the overhead switch panel housing showed little heat damage other than to a localized area at the aft end. There was no indication that the fire started inside the housing and propagated out. The heat damage pattern shows that the heat originated outside the housing, and entered through the aft cut-outs.

1.14.11.7 Forward galleys

Galley 2 was not electrically powered, and none of the recovered wires from inside galleys 1 and 3 displayed any heat or fire damage. All of the heat damage and soot accumulation on the top portions of these galleys was from exposure to an external fire. There was no arcing damage to any of the identified galley wiring that was recovered.

The galleys would have been in use at the time of the detection of the initial odour in the cockpit. If a galley power feed wire were to arc, the galley load control unit would sense a differential between the input and output, and would shut off power to the galley. The appropriate galley OFF light in the cockpit overhead control panel would illuminate, and a galley OFF Level 1 (amber) alert would be generated. This would likely have been apparent to the flight crew. There were no CVR references to any galley problems. The available information indicates that the fire did not start within one of the galleys.

1.14.11.8 Overhead aisle and emergency light fixtures

Discolouration was found on some of the cabin ceiling panel assemblies, both in the wreckage from SR 111 and during subsequent examinations of other MD-11 aircraft. The discolouration was caused by an overheating of the overhead aisle and emergency light assemblies by the lamp. Other than the potential for dust and lint deposits, there is no flammable material, such as MPET cover material, in close proximity to the light fixtures. It is assessed that the fire was not initiated by one of these light fixtures.

1.14.11.9 Emergency lights battery pack

Examination of the battery pack showed that, although it was extensively heat damaged, the heat occurred from the outside in (see Figure 27). This indicates that the fire did not start from a heat condition, such as thermal heating, within the battery pack.

1.14.12 Fire propagating materials

1.14.12.1 Insulation blankets–General

Thermal acoustic insulation materials are used extensively throughout the aircraft fuselage to maintain comfortable cabin temperatures, and to reduce the noise entering the passenger cabin and cockpit (see Figure 4). While material, such as fluoropolymer composite or polyethylene foams have been used for this purpose, the most popular choice is the insulation blanket. These insulation blankets are typically installed immediately adjacent to the inside of the fuselage skin, over the frames and around the outside of air conditioning ducts.

Insulation blanket construction consists of a batt of fibreglass insulating material encapsulated by a protective cover in the form of a thin moisture barrier film. This protective cover is a composite construction in which a thin web-like polyester or nylon scrim can be glued to the film material for the purpose of producing a tear-stop. Splicing tape may also be used to seal several insulation blankets into a single unit. Thermal acoustic insulation materials must comply with flammability requirements described in FAR 25.853, Appendix F.

Factors that are considered when selecting the cover material for the blankets include durability, fire resistance, weight, impermeability, and ease of fabrication. Two materials that are widely used in the aviation industry and that were used in the occurrence aircraft are polyethylene terephthalate (PET) and PVF. PET material is commonly known as Mylar®,^{Footnote 69} and PVF material is commonly known as Tedlar®.^{Footnote 70} Both materials could be either metallized or non-metallized, and both were approved for use based on the applicable FAA certification tests at the time.

The flammability test used to certify MPET-covered insulation blankets was the vertical Bunsen burner test (see Section 1.14.1.2). This test involved suspending a strip of insulation material vertically over a Bunsen burner, applying flame for 12 seconds, and then removing the flame. To pass the test, a minimum of three specimens of insulation blanket material must self-extinguish within an average flame time of 15 seconds after the flame is removed. Also, the average burn length must not exceed 20 cm (8 inches), and drippings from the insulation blanket material must not flame for longer than an average of 5 seconds. MPET-covered insulation blankets met these requirements: when exposed to the Bunsen burner, it immediately shrivelled up and shrank away from the burner and did not ignite.

Douglas used MPET-covered insulation blankets in various models of production aircraft between 1981 and 1994. The use of MPET-covered insulation blankets was superseded by non-metallized PET-covered insulation blankets.

In the occurrence aircraft, which was built in 1991, MPET-covered insulation blankets were used to insulate the fuselage. They were also used to insulate some of the air conditioning ducts. Most of the air conditioning ducts were insulated with metallized polyvinyl fluoride (MPVF)-covered insulation blankets (see Figure 4).

1.14.12.2 Past known occurrences

Between November 1993 and March 1999, seven known occurrences took place in which either MPET- or MPVF-covered insulation blankets had been ignited and propagated flame. These occurrences involved one MD-87, one MD-82, two B737-300s in 1994 and 1995, and three MD-11s in 1995.

The ignition source for each fire was relatively small, including wire arcing, hot metal shavings, and a ruptured light ballast case. In all but one instance, the fires occurred when the aircraft was on the ground. In this one instance, the time the fire occurred could not be determined, as the damage was only discovered during subsequent maintenance.

The Civil Aviation Administration of China (CAAC) investigated three of the above occurrences: the two Boeing 737 aircraft that had PET and one MD-11 aircraft that had MPET. According to the documentation available, the CAAC conducted testing on the PET-covered insulation blanket material (Boeing material specification BMS8-142). It was found that once ignited, the material would be completely consumed by fire. In a report dated 24 May 1996, which was forwarded to the FAA, the CAAC recommended that the manufacturer be advised that "the insulation blanket installed in the Boeing 737-300, [and] MD-11 airplanes is fire flammable. They should make a prompt and positive response."

In a response to the CAAC report dated 24 July 1996, the FAA stated that they intended to investigate the behaviour of insulation blanket materials under larger scale conditions. The FAA also stated that, while the tests conducted by the CAAC on the PET were illustrative, the type of CAAC testing conducted (igniting at the sewn edge of the sample material) was not required for certification.

On 9 August 1996, Douglas released an AOL to operators of several of its aircraft types concerning insulation blankets. The AOL contained the following information:

As a result of recent MD-80 and MD-11 ground fire incidents involving insulation blankets covered with metallized Mylar material, Douglas has examined its methods for flammability testing of insulation blankets. We have concluded that an expanded set of test conditions, which includes additional ignition conditions beyond those previously required, better determines blanket flammability characteristics. All insulation blanket materials delivered on Douglas manufactured aircraft have met the applicable requirements for FAA certification. Douglas recommends that operators discontinue use of the reference (D) metallized Mylar blanket covering material and reference (E) tapes. Douglas also recommends that Douglas' expanded test criteria, which is published in the enclosed reference (C) DMS 2446, be applied when operators are replacing blankets in aircraft in-service....

Douglas has made the FAA and industry aware of our conclusions relative to flammability testing and is participating in an FAA/Industry Flammability Working Group that is addressing testing methods and the flammability of materials such as those used for insulation blankets. The working group will perform flammability tests of blanket covering materials from known suppliers, testing specimens of different sizes in different test setups. From the data derived from the working group tests and from tests that Douglas will continue to conduct, Douglas intends to develop an even more rigorous set of flammability test requirements.

DMS 2446 was dated 5 August 1996 and introduced a particular flammability test that was to be used by all McDonnell Douglas suppliers of insulation blanket assemblies. The test, developed by aircraft manufacturers, involved exposing a sample of the insulation blanket assembly to ignited cotton swabs saturated with isopropyl alcohol (the cotton swab test). McDonnell Douglas had found that when tested by this method, MPET-covered insulation blankets ignited and continued to burn.

The AOL went on to explain that McDonnell Douglas was currently installing PET-covered blankets in production aircraft, and that they were seeking to identify improved materials that would meet a more rigorous set of flammability test conditions, while at the same time meeting other desirable characteristics. Ultimately, McDonnell Douglas issued an SB, dated 31 October 1997, that recommended that MD-11 operators remove and replace MPET-covered insulation blankets with MPVF-covered insulation blankets. The SB also declared that MPVF-covered insulation blankets would be used in production aircraft.

In November 1989, the FAA, along with other regulatory authorities and various industry representatives, formed the International Aircraft Materials Fire Test Working Group. In 1996 to 1997, this working group conducted testing to evaluate the performance of various insulation blanket cover materials against both the Bunsen burner certification test and the cotton swab industry tests. This resulted in a document disseminated by the US Department of Transportation, dated September 1997 and entitled Evaluation of Fire Test Methods for Aircraft Thermal Acoustical Insulation (DOT/FAA/AR-97/58). The following excerpts are from this document:

This report presents the results of laboratory round robin flammability testing performed on thermal acoustical insulation blankets and the films used as insulation coverings. This work was requested by the aircraft industry as a result of actual incidents involving flame propagation on the thermal acoustical blankets. Vertical flammability testing was performed as specified in Federal Aviation Regulation (FAR) 25.853, Appendix F. In addition, a cotton swab test developed by the aircraft manufacturers was also evaluated. These cotton swab tests were performed by placing ignited alcohol-saturated cotton swabs on a test-sized blanket and measuring the longest burn length. Test results indicated that the cotton swab tests produced consistent test results, whereas the vertical flammability tests did not. This was especially apparent with one particular film covering which passed the vertical test according to 50% of the participating laboratories while this same film during the cotton swab tests was reported to have been consumed by all but one laboratory which reported that 75% of the sample was destroyed....

Metallized poly (vinyl fluoride) (PVF) and metallized and nonmetallized polyester poly (ethylene terephthalate) (PET) are currently the most widely used films in the aircraft industry....

In air, PET burns with a smoky flame accompanied by melting, dripping, and little char formation. Therefore, fire-retardant treatments are necessary. The fire-retardent treated grades are generally prepared by incorporating halogen or nonhalogen containing materials as part of the polymer molecules or as additives. Metal oxide synergists such as antimony oxide are frequently included. Although fire retardent PET films are resistant to small ignition sources in low heat flux environments, they can burn readily in fully developed fires....

In air, biaxially oriented PVF film (Tedlar) has burn characteristics similar to PET film....

The front face of the metallized PET blanket sample was totally consumed when subjected to the cotton swab test. This was reported by all but one lab, which reported that 75% of the front face was consumed. This is in sharp contrast to the vertical flammability test results which indicated that the metallized PET/fiberglass samples (compressed and noncompressed) passed most of the time. Hence, the cotton swab test proved itself to be a more reproducible test than the vertical flammability test for this particular film/fiberglass assembly....

The grade of metallized PET film evaluated in this round robin is flammable and possibly could propagate a fire in a realistic situation.

The Evaluation of Fire Test Methods for Aircraft Thermal Acoustical Insulation document described five incidents (as included in the seven occurrences noted above) that occurred between 1993 and 1995 and involved flame propagation on insulation blankets.

Subsequent to the SR 111 accident, in a release dated 14 October 1998, the FAA administrator stated that the FAA would develop a new test specification for aircraft insulation materials and would require that existing materials be replaced with insulation that would pass the new test. On 20 September 2000, the FAA issued an NPRM that advocated upgraded flammability standards for all thermal acoustic insulation materials.

By the end of 1997, McDonnell Douglas had discontinued the use of both MPET- and PET-covered insulation blankets in production aircraft. However, use of MPET-covered insulation blankets continued until 2000, when the FAA issued ADs requiring the removal of such blankets from existing aircraft. The FAA also issued an NPRM proposing new flammability standards for thermal acoustic insulation materials.

See the supporting technical information on this topic.

1.14.12.3 Contamination effects on insulation blanket cover material

Testing carried out on behalf of the TSB showed that several materials found in the fire-damaged area of SR 111 are flammable even before they are exposed to their intended operating environment; that is, they are flammable in an uncontaminated state. Examples of such flammable materials include insulation blanket cover materials, splicing tapes, polyethylene foam, and silicone elastomeric end caps.

Little industry guidance is available to quantify the effects of contamination. According to documentation from various sources,^{Footnote 71} the flammability characteristics of materials can degrade while in service; that is, when they are exposed to contaminants such as dust, lint, adhesives, grease, oil, or corrosion inhibitors.^{Footnote 72} No corroborating test results were available to support this information. In some flammability testing conducted by the TSB in which lightly contaminated insulation blankets removed from an in-service MD-11 were tested, no appreciable differences were noted in the flammability characteristics of the material.

The aviation industry has yet to quantify the impact of contamination on the continuing airworthiness of insulation blankets. However, research has shown a connection between flammability and contamination. The following extract is from the FAA's Flight Standards Information Bulletin 00-09, issued 28 September 2000 and expired 30 September 2001 entitled Special Emphasis Inspection on Contamination of Thermal/Acoustic Insulation:

Research data has shown, however, that the flammability of most materials can change if the materials are contaminated. Contamination may be in the form of lint, dust, grease, etc., and can increase the material's susceptibility to ignition and flame propagation.

During the examination of several Swissair MD-11 aircraft during the investigation, contamination (as described in Section 1.12.5) was observed on items such as light fixtures and wire harnesses. Contamination was also noted on insulation blanket cover materials within the fire-damaged area; however, little or no contamination was evident in the areas above the cockpit ceiling.

1.14.13 Potential increased fire risk from non-fire-hardened aircraft systems

Under regulations in place at the time the MD-11 was certified, no requirement existed to determine whether a failure of any material used in an aircraft system would exacerbate a fire in progress. A premature breach of certain systems, such as oxygen, hydraulic, and conditioned air, could exacerbate an in-flight fire.

The crew oxygen supply lines in the MD-11 were originally manufactured from aluminum tubing. During aircraft manufacture, the aluminum lines were found to be susceptible to handling damage; therefore, the tubing material, along with the majority of fittings, were changed to corrosion-resistant (CRES) steel. Although McDonnell Douglas replaced the aluminum tubing and many of the fittings with CRES steel, McDonnell Douglas continued to use aluminum cap assemblies (e.g., AN 929-6) on unused but pressurized lines. Such an aluminum cap assembly was used on the 8-cm (3-inch) long stainless steel line that was branched off the main oxygen supply line located above the cockpit ceiling at STA 374. This cap assembly was installed in such a way that it protruded through the insulation blankets. During the fire, this area was exposed to flames and heat.

Furnace testing was conducted at the TSB Engineering Branch on a representative CRES steel line/aluminum cap assembly to observe the effects of elevated temperatures on the dissimilar metals. The normal operating range of the MD-11 crew oxygen system is 62 to 85 psi. During the tests, the line was pressurized to 70 psi, and uniform heating was applied. On some tests, leakage occurred at temperatures as low as 427°C (801°F); at temperatures above 427°C (801°F) the aluminum caps lost their installation torque.

Tests were conducted at temperatures between 566°C (1 051°F) and 593°C (1 099°F). After an exposure of approximately 10-and-a-half minutes, the aluminum cap assembly would typically fracture into two pieces, leaving the end of the line fully open. At this temperature range, leakage would occur prior to the fracture.

Tests were also conducted at temperatures of 649°C, 704°C, and 760°C (1 200°F, 1 300°F, and 1 400°F). The aluminum cap assemblies fractured at approximately 5 3/4 minutes, 4 minutes, and 3 1/4 minutes respectively. Metallurgical analysis of the cap fracture surfaces showed that these temperatures caused grain growth to take place, and that the failures occurred in the form of inter-granular fractures along the weakened grain boundaries. In these tests, no discernible leaking took place before the fracture, as the accelerated grain growth caused the deformation and fracture to occur before the time required to initiate a leak.

For comparison, similar testing was conducted using CRES steel caps instead of the aluminum caps. With the CRES steel caps, there was no loss of installation torque, and the caps did not leak or fracture, even when the assembly was exposed to a temperature of 760°C (1 400°F) for 20 minutes.

The testing was considered conservative in nature, in that uniform heating was used. In the occurrence aircraft, there would likely have been non-uniform heating effects. For example, since the cap assembly protrudes through the insulation blankets and the line does not, the cap assembly would be heated first by the fire and to a greater extent than the line. In addition, a thermal gradient would already exist between the supply line, which is adjacent to the cold airframe exterior, and the cap assembly, which is exposed to the warmer interior.

If this end cap were to leak or fracture during a fire, pure oxygen would enter the fire environment, significantly exacerbating the fire situation. Also, a cap failure would result in a loss of pressure in the line; this would stop the flow of oxygen to the pilots' oxygen masks.

Within the area of the fire damage, elastomeric end caps were used on the air conditioning ducts. Fire tests disclosed that the elastomeric end caps could be easily ignited by a small flame ignition source. Once ignited, the integrity of the end caps was destroyed by a self-propagating flame front. Fibreglass hoses and connectors were also used on the air conditioning system throughout the aircraft. This material is heat tolerant; nevertheless, when tested in a cone calorimeter, the material ignited about two-and-a-half minutes after exposure to a heat flux of 25 kilowatts per square metre, which is equivalent to about 1 095°F (591°C). A breach of the air conditioning system in the area of the fire would introduce a significant flow of air that would exacerbate the fire. Heat damage to the structure in the reconstruction mock-up indicates that such temperatures were likely reached or exceeded in some areas where fibreglass hoses were installed.

FAR 25.1309 requires that a system safety analysis be conducted as part of a system's certification process. Although it is an established aviation industry practice, during the certification process, to consider the consequences of a system's failure, typically the system safety analysis does not include an assessment of the consequences of the system's failure as a result of a fire in progress.

See the supporting technical information on this topic.

1.15 Survival aspects

The high forces created when the aircraft struck the water resulted in a non-survivable accident.

1.16 Tests and research

This section describes the various testing methods used, and inspections and research conducted, during the SR 111 investigation, as well as the results of these activities. It also presents statistics from other occurrences involving smoke or fire.

See the supporting technical information on this topic.

1.16.1 AES examination of the recovered arced beads

All of the copper wire melt beads from SR 111 were examined by Auger electron spectroscopy (AES)^{Footnote 73} (see Section 31.19.4.13). 3AES3 provided a method to determine quantitatively, the surface chemistry or elemental composition of the melt beads as a function of depth below the surface. AES examination had the added benefit of being essentially non-destructive, as the depth profiling did not normally go below 5 000 Angstroms.^{Footnote 74} The elemental chemical data collected could be used to provide a comparative analysis between samples. Review of the available literature indicated that it may be possible to use this comparative analysis to differentiate between a copper bead arced in a clean environment (pre-fire) and one arced during a fire in a smoke-filled environment. Wires that arced in a clean environment could be identified as possible initiating events.

To assist in developing a protocol for the examination and comparative analysis of copper beads by AES, a number of beads were formed under known arcing and fire conditions. Twenty-four of these exemplar beads were examined and analyzed in a blind test. The results of these tests were that 7 of 14 beads formed in a clean environment were correctly identified as such. Of the 10 beads formed in a fire environment, 1 was incorrectly characterized as pre-fire, and 9 were characterized as inconclusive. This latter characterization highlighted a problem in using the AES methodology to assess arc beads that had been subjected to an ongoing fire, regardless of the environment present at the time of the arc. The fire subjected the copper melt surfaces to heavy oxidization that formed a crust, or environmental cap. When this cap was present, it was not possible to make any determination about the environment at the time the bead was formed.

Several other difficulties were encountered using the AES technique as a means to collect data for characterizing the environment surrounding the bead when it was formed. The irregular surface shapes of the copper melt sites on the SR 111 beads made it difficult to find a suitable flat surface on which to conduct the examination. Many of the sites were contaminated with the remnants of charred wire insulation and whitish- and greenish-coloured precipitates or deposits caused by exposure to sea water. This contamination resulted in a static charge build-up during the testing process, and made it difficult to locate sites that had been pre-defined for examination. Although each of the beads was ultrasonically rinsed in distilled water before being examined, this procedure did not remove all of these artifacts. Nor could the artifacts be readily removed by any other method; that is, given the small depths being examined, any physical distortion of the surface caused it to be potentially unusable for AES examination.

During the testing, there was a lack of repeatability, even in the data that was collected from sites that were just microns^{Footnote 75} apart on the same bead. In many cases, this lack of repeatability led to different interpretations of the environment present at the time the bead was formed. As the AES test results did not yield repeatable data that could be consistently interpreted, the comparative analysis using the AES methodology was not used in assessing the involvement of individual beads in the lead arcing event.

1.16.1.1 Wire inspection of in-service MD-11 aircraft

Aircraft wiring in several in-service MD-11s was examined for sources of potential arcing and for any other sources of inappropriate heat generation. TSB investigators visited two maintenance facilities and examined several MD-11 aircraft in the areas of known heat damage in the SR 111 aircraft. The following anomalies were discovered on one or more of the aircraft examined:

• Chafed and cut wires in the forward cabin drop-ceiling area above both the L1 and R1 doors;
• Light chafing of the wire insulation topcoat on several wires behind the cockpit overhead CB panel, in the vicinity of where wire bundles enter the overhead switch panel housing;
• Damaged, cracked, or chafed wires in several other areas;
• Broken bonding wires,^{Footnote 76} and wires exhibiting bend radii that were smaller than manufacturers' specification;
• Wire terminal connections with insufficient torque;
• Inconsistencies in the routing of wires and wire bundles;
• Physical openings in the smoke barrier installed above the cockpit wall between the cockpit and cabin; and
• Inconsistencies in the installation location of the emergency lights battery pack above the cockpit door entrance.

No direct relationship between the wiring discrepancies discovered during these inspections and the damaged wires from the Swissair 111 wreckage was established.

1.16.2 Map light testing and research

In December 1999, Swiss AAIB investigators, on behalf of the TSB, monitored a Swissair program to remove MPET-covered thermal acoustic insulation from their MD-11 aircraft. Investigators discovered that the insulation material adjacent to some of the map lights showed signs of heat damage. In many cases, the back of the map lights installed in the flight crew positions were in direct contact with the insulation material. This combination provided a potential source of ignition adjacent to a flammable material.

Subsequent examination of the Hella map lights, on the Swissair MD-11 fleet and other MD-11s maintained by SR Technics, revealed that some had damage to the insulating protective caps ranging from cracks to missing pieces; instances of arcing damage were also found on the metal contact spring and the carrier frame.

Based on this information, the TSB issued an Aviation Safety Advisory to the NTSB and relevant stakeholders on 3 March 2000. On 20 April 2000, the FAA issued an AD requiring an inspection of the Hella map light installations on US-registered MD-11s. Although this AD did not mandate that inspection results be reported to the FAA, some voluntary responses were forwarded to Boeing. These results revealed that about 40 per cent of the map lights sampled had some discrepancy, such as heat damage to the wire and cracked insulating protective caps.

Subsequent testing of the Hella map light demonstrated that, with pieces missing from the insulating protective cap, arcing between the metal contact spring and the carrier frame occurred at two locations on the carrier frame. To simulate potential in-service conditions, the Hella light was exposed to vibration during an arcing event. It was observed that the vibration extended the duration of the arcing, and the CB did not trip.

To simulate an actual aircraft installation, a map light was tested in a confined space, surrounded by, and in contact with, MPET-covered insulation blankets. Temperatures in the confined space stabilized at 151°C to 159°C (304°F to 318°F). After two months of continuous testing, the inside of the insulation blanket exhibited heat damage that was similar to the damage noted on in-service aircraft installations.

To assess the actual operating conditions, temperature measurement strips were fastened to the insulation blankets behind the Hella map lights in three MD-11 aircraft. A maximum temperature of 77°C (171°F) was recorded and there was no heat damage to the insulation blankets. One of the test aircraft had more space between the map lights and the insulation blanket. The space provided better ventilation around the map lights, which resulted in a lower operating temperature.

Further examination of the Hella map light revealed that there were additional failure modes, other than damage to the insulating protective cap, in which the light could be involved in an arcing event. The additional possibilities are as follows:

• A short-circuit can occur between the U-shaped universal joint suspension bracket and the wire terminal connection;
• A short-circuit can occur between the U-shaped universal joint suspension bracket and the ON/OFF microswitch assembly; and
• A short-circuit can occur between the spare bulb holder and the ON/OFF microswitch assembly.

Prompted by an FAA Safety Significant Finding unrelated to this investigation, Hella carried out tests to measure the heat developed by the MD-11 map light installation. As a result of the testing, Hella drafted an SB, for the replacement of the 11.5 W halogen lamp with a 7 W incandescent bulb.

1.16.3 Airflow flight tests

Two separate flight tests were conducted to assess airflow patterns in the cockpit; the space above the cockpit ceiling, and the attic space above the forward cabin ceiling. The first test was conducted by the TSB on 27 January 2000 at Long Beach, California, using Swissair MD-11 aircraft HB-IWE and Boeing equipment and facilities. The second test was conducted on 2 December 2000 by Swissair and Boeing in Zurich, Switzerland, using Swissair aircraft HB-IWE. The Swiss AAIB attended the second test flight and collected data on behalf of the TSB.

The airflow flight tests yielded the following results:

• Smoke originating inside the flight crew compartment, forward of the cockpit rear wall, does not move aft into the cabin, but is mainly drawn downward into the avionics compartment below the cockpit floor via the left- and right-side rudder pedals.
• Smoke originating from above the ceiling liner on the right side of the cockpit or behind the avionics CB panel initially migrates to the right and goes down the ladder; when the volume of smoke is sufficient, it enters the overhead panel housing through the aft oval cut-outs and enters the cockpit through the cut-outs for the fire handles.
• Smoke originating behind the ceiling liner on the left side of the cockpit enters the cockpit in one or both of two locations: around the left window air diffusers, or through the left diffuser control slide panel opening.
• The flow of smoke originating anywhere forward of the cockpit rear wall is not affected by whether the ECON switch (cabin air recirculation fans) is selected to the ON or OFF position.
• With the ECON switch selected to the ON position, smoke originating aft of the cockpit wall, in the attic space above the forward cabin drop-ceiling, is mainly drawn aft to the recirculation fans. However, some smoke near the cockpit rear wall could be drawn forward into the cockpit attic or down the cable drop and into the cockpit. Upon entering the cockpit through the cable drop, the smoke can migrate forward to swirl in front of the left-side cockpit windows enroute to the captain's rudder pedals, or go from the closet to the right and then up to swirl in an area around the upper outboard corner of the upper main CB panel before continuing forward to the first officer's rudder pedals.
• With the ECON switch selected to the ON position, smoke released in the ceiling area above the L1 and R1 doors was only smelled in the passenger cabin in the area below these two areas.
• With the ECON switch selected to the OFF position, the air in the attic space above the forward cabin drop-ceiling would flow forward toward the cockpit. Smoke produced in the attic migrates with the airflow toward the cockpit, drawn by the air being exhausted from the cockpit via the avionics compartment cooling fan, through the outflow valve. Smoke filling the attic space also tends to drift down into the passenger cabin through any seams or openings available.

1.16.4 Analysis of cockpit sounds recorded on the CVR

During the playback of the CAM channel on the CVR, numerous "click" sounds were heard, many of which were subjectively identified as typical events in a cockpit, such as radio keying, book binders opening or closing, cutlery striking a plate, and the cockpit door opening or closing. Other clicks could not be readily identified, and an attempt was made to determine whether any of the clicks could be the sound of a CB tripping.

Several tests were conducted in an MD-11 cockpit during which CBs at various locations on several CB panels were tripped in a noise environment similar to in-flight conditions. The audio recordings from this testing, and the unknown "clicks" from the SR 111 CVR were digitized and analyzed at the Industry Canada Communications Research Centre. A cross-correlation study was used to detect any similarities between the "click" segments of each digitized file. The analysis of the spectra of the original signals and the cross-correlations revealed that the background noise environment had a significant effect on the signal. Attempts to remove the effects of the background noise environment from the "click" by notch-filtering, linear prediction, spectral subtraction, and median smoothing were unsuccessful.

The results of the Industry Canada Communications Research Centre study were inconclusive. Subjectively, some of the sounds recorded on the SR 111 CVR were similar to the CB sounds recorded during the test in the MD-11 cockpit; however, none were scientifically proven to be similar.

1.16.5 Simulator trials

Several MD-11 simulator sessions were conducted in support of the accident investigation. The sessions primarily assessed MD-11 descent performance, and the potential effects of various system failures. Because of the lack of specific information about the initial cues available to the pilots, the loss of aircraft systems, and the degradation of the cockpit environment in the last five minutes of the flight, no attempt was made to replicate the actual flight.

For some of the testing that was completed to assess systems failures, the simulator was set to the atmospheric conditions, aircraft performance, and aircraft configurations similar to those experienced by SR 111 at the various times during the last 30 minutes of the flight. Various failures of aircraft systems that were recorded on the FDR during the 92-second period immediately prior to recorder stoppage were introduced. Observations were made on the panels, pedestal, and DUs in the cockpit when these failures were introduced. Also, the SMOKE ELEC/AIR selector was rotated to various positions after the failures were introduced. Another test during this session was designed to assess handling qualities of the MD-11 in flight with LSAS failure and a complete electrical failure. It was determined that the simulator was still flyable in each of the following situations:

• With only one channel of the LSAS;
• With no LSAS; and
• With no electrical power available.

1.16.6 Theoretical emergency descent calculations

1.16.6.1 General

Theoretical performance calculations, based on manufacturer's performance charts, were completed to assess the capability of the MD-11 in achieving an emergency landing at the Halifax airport in the minimum time possible, from FL330. The objective was to determine the point along the SR 111 route of flight at which the aircraft would have had to start an emergency descent that would result in the earliest possible landing time on Runway 06 in Halifax. The calculations were based on actual wind and other environmental factors, actual SR 111 weight and balance figures, and performance data for a fully serviceable aircraft.

When completing the theoretical calculations, flight crew decision making was not taken into account nor were the various systems-related aircraft unserviceabilities or the deteriorating cockpit environment.

The results of these calculations provide a benchmark from which to consider the limited initial cues available to the pilots and the actual decreasing flyability of the aircraft in the last minutes of its flight vis-à-vis the minimum possible time necessary to fly to the Halifax International Airport and complete a safe landing under ideal theoretical conditions.

1.16.6.2 Calculations

To determine the earliest possible potential landing time, engineering simulator data, in combination with FDR-derived actual winds, was used to calculate the aircraft's ground speed during the emergency descent. The ground speed was then mathematically integrated to derive displacement or distance travelled over time. The calculation profile assumed direct tracking to the Halifax Golf beacon from the point of the initiation of the emergency descent, followed by a straight-in segment from the beacon to the threshold of Runway 06.

The calculations identified one point along the flight path where the distance^{Footnote 77} from the aircraft to the Golf beacon was equivalent to the distance travelled^{Footnote 78} along the optimal emergency descent profile. This point coincided with a time of 0114:18. A descent initiated at that time would have required a track of 044 degrees True to the Golf beacon, and would have covered a calculated distance of approximately 62 nm. The derived winds indicated a significant tailwind component for the initial seven minutes of the emergency descent, followed by light headwinds for the remainder of this particular descent and approach.

To examine the potential for SR 111 to be able to land successfully at Halifax airport if an aggressive emergency diversion^{Footnote 79} had been started at 0114:18, the known significant aircraft systems-related events were transposed onto the theoretical emergency descent profile.

If the aircraft had followed the theoretical emergency descent profile, the first systems failure event apparent to the pilots-the disconnect of the autopilot at 0124:09-would have occurred on the landing approach in the vicinity of the Golf beacon, approximately 5 nm from the threshold of Runway 06. The aircraft would have subsequently experienced progressive systems failures on the approach. When the flight recorders stopped at 0125:41, the aircraft would have been at approximately 700 feet above the runway threshold elevation. The earliest estimated threshold crossing time was 0126:17, which would have been 1 minute, 35 seconds, after the pilots had declared an emergency. Approximately 35 more seconds would be required to land and stop the aircraft; therefore, the completion of the landing would have been at approximately 0127.

In reality, the crew were unaware of the existence of an on-board fire and assessed the source of smoke and fumes as the air conditioning system; the Air Conditioning Smoke Checklist does not call for landing the aircraft immediately. At 0119:50, the aircraft was 30 nm from the threshold of Runway 06, descending at about 3 300 feet per minute (fpm) through FL210, at an airspeed of 320 knots indicated airspeed (KIAS). The pilots indicated to ATC that they needed more than 30 nm.

Completion of the theoretical descent performance calculations enabled the investigation team to assess the pilots' decision that more than 30 nm was needed to complete a landing in Halifax. For comparison, if the crew had continued to the airport on the assigned heading and began an emergency descent profile from 30 nm, they would have intercepted the final approach track at an estimated 15 nm from the threshold while approaching an altitude of approximately 10 000 feet with an airspeed of 355 KIAS. The theoretical descent performance calculations, from a starting time of 0114:18 would have put the aircraft in the same position at approximately 4 000 feet and 200 KIAS. The difference in altitude and speeds would require the aircraft to lose significant altitude and speed requiring off-track manoeuvring, which can lead to a destabilized approach. Therefore, the calculations support the assessment made by the SR 111 pilots at 0119:50 that the aircraft needed more than 30 nm from a descent performance viewpoint.

1.16.7 Statistics for occurrences involving smoke or fire

1.16.7.1 Boeing incident statistics

The Boeing Company performed an analysis of reported in-service events, occurring between November 1992 and June 2000, that involved smoke, fumes, fire, or overheating in the pressurized areas of Boeing-manufactured aeroplanes.^{Footnote 80} The events under study were assigned one of three general source categories: air conditioning, electrical, or material. Boeing attributed 64 per cent of the events under study to electrical sources, 14 per cent of the events to air conditioning sources, and 12 per cent of the events to material sources. The remaining 10 per cent of the reported events did not include sufficient information to determine the source of the smoke, fumes, fire, or heat. For those events involving MD-11 or DC-10 aircraft, 51 per cent were classified as being electrical in nature, 21 per cent were attributed to air conditioning, and 15 per cent were associated with material causes.

The Boeing study concluded that "larger airplanes with more complex systems show a predominance of smoke events of electrical origin, compared with air-conditioning and material smoke events." The Boeing study also concluded that "for smoke events in which the flight crew could not determine the smoke source, most were subsequently determined by maintenance crews to be of electrical origin."

1.16.7.2 Review of in-flight fire accident data

The TSB reviewed data on in-flight fires that occurred between January 1967 and September 1998 to determine the average time between when an in-flight fire is detected and when the aircraft either ditches, conducts a forced landing, or crashes. The review was limited to fires in commercial transport aircraft with a maximum take-off weight of more than 50 000 lb. Included in the review were any fires that took place inside the fuselage. Events involving engine fires, wheel well fires, and explosions were not considered, nor were events that concluded with a successful landing. The data showed that in 15 representative occurrences, between 5 and 35 minutes transpired between the detection of the first fire symptoms and the crash of the aircraft. Although the circumstances varied in each of these occurrences, the research indicates that when an in-flight fire continues to develop, it can, in a very short time, lead to catastrophic results. In the case of SR 111, the elapsed time between when the unusual odour was first noticed in the cockpit and when the aircraft struck the water was approximately 20 minutes.

The Boeing study, referred to in Section 1.16.7.1, had similarly observed that "[r]eview of historical data on the rare fire events that resulted in hull loss indicates that the time from first indication of smoke to an out-of-control situation may be very short—a matter of minutes."

1.16.8 Electrical ignition tests of MPET-covered insulation blankets

Electrical discharges in the form of arcs or sparks can produce localized temperatures in excess of 5 500°C (9 932°F). A sustained short-circuit event will cause a conventional CB to trip and de-energize the faulted circuit. However, a CB may not trip when an intermittent short circuit exists.

Tests were conducted to characterize the ignition properties and determine whether MPET-covered insulation blankets would ignite when exposed to electrical sparks produced by ground shorts from wires carrying 115 V AC and 28 V DC current. It was observed that MPET-covered insulation blankets would ignite and propagate a flame when exposed to an electrical arc or spark. However, ignition was sporadic in that it sometimes occurred with the first strike of the arc and other times it was not achieved after numerous attempts. The arcs were struck by hand and typically resulted in the tripping of the CB. It appears that electrical arcs were sufficiently rapid in onset and localized to overcome the propensity of a cover material constructed with thin-film material, such as MPET, to shrink away from a heat source.

In one such test, an MPET-covered insulation blanket, similar to those in the occurrence aircraft, was placed between the vertical frames in a section of aircraft fuselage. The blanket was exposed to an intermittent electrical short between an exposed 115 V wire and the grounded fuselage. The MPET-covered insulation blanket ignited, causing a flame to propagate vertically and horizontally across the face and rear surface of the blanket.

1.16.9 Computer fire modelling

During this investigation, the analysis of the fire initiation and propagation was derived from a combination of sources, including detailed wreckage examination and reconstruction, laboratory burn test information, airflow patterns, the sequence of events, and the events timeline. Fire modelling was also used during the latter part of this analysis process.

In January 2002, the TSB contracted the Fire Safety Engineering Group (FSEG) at the University of Greenwich^{Footnote 81} to conduct computational fluid dynamics (CFD)^{Footnote 82} modelling using SMARTFIRE® software developed by the FSEG. The objective was to integrate information into a fire field model^{Footnote 83} to study the potential effects of different variables on airflow and fire behaviour. The modelling helped to develop better insight into and understanding of the fire, and assisted in evaluating where the fire could have originated. This work also assisted in the interpretation of heat damage patterns by providing data on potential heat release and loss rate possibilities.

The CFD fire field model incorporated information such as the following:

• three-dimensional computer-aided design (CAD) exterior and interior aircraft geometry and construction details;
• material properties and associated fire burn test results;
• design and flight test airflow data; and
• atmospheric and flight profile information from the occurrence aircraft's FDR.

The modelling technology allowed investigators to conduct a series of full-scale virtual burns, using powerful computers to complete a multitude of complex calculations involving the interaction of processes, such as conduction, convection, and radiation. The computer processing of calculations for a single fire initiation scenario often took several days of continuous, uninterrupted, computational time. Subjects studied included potential odour and smoke migration paths, heat release, and complexities, such as heat loss rates to the outside atmosphere through the airframe. As full-scale aircraft fire testing was not an option, it would not have been possible to obtain information about in-flight fire initiation and propagation effects without the use of the fire modelling.

The CFD modelling substantiated the fire scenario presented in this report. When the model was run using the airflow flight test data, air was observed to be drawn into the cockpit interior in the area of the avionics CB panel, and to migrate through the cockpit into the avionics compartment as described in Section 1.16.3. The fire modelling also showed that initial fire propagation and growth characteristics were consistent with the fire scenario presented in this report. For the latter stages of the fire, only limited assessment was done of the information from the fire modelling because of the many permutations and combinations of possible events.

See the supporting technical information on this topic.

1.17 Organizational and management information

This section includes information about the structure and management of the SAirGroup, Swissair, SR Technics, the Swiss FOCA, the FAA, and The Boeing Company, all of which were involved with either the construction, maintenance, or operation of the occurrence aircraft. Specific information is provided in this section on the Swissair Flight Safety Program, the SR Technics Quality Assurance Program, and the SR Technics Reliability Program.

1.17.1 SAirGroup/Swissair/SR technics

The original Swissair company was founded in 1931 as Swissair Swiss Air Transport Company Limited. This organization evolved into a multi-faceted company, which included several diverse enterprises, such as the airline, aircraft maintenance, airport ground handling, software development, and real estate. In March 1996, a new management structure was introduced, creating a holding company structure organized to provide improvements in management responsibility and accountability. By 1997, the Swissair Swiss Air Transport Company Limited was reorganized into a group of holding companies named SAirGroup.

At the time of the SR 111 occurrence, SAirGroup functioned as the parent company for an aircraft leasing company (Flightlease AG) and the following four subsidiary holding companies: SAirLines, SAirServices, SAirLogistics, and SAirRelations. The former airline business unit became an operational subsidiary of SAirLines, but retained the name of Swissair Swiss Air Transport Company Limited (referred to as Swissair in this report). Likewise, the former aircraft maintenance business unit became a fully owned subsidiary of SAirServices and was named Swissair Technical Services Limited. Swissair Technical Services Limited became an autonomous company on 1 January 1997 known as SR Technics Group AG (referred to as SR Technics in this report).

At the time of the SR 111 occurrence, SR Technics had more than 3 000 employees and was responsible for aircraft maintenance for Swissair, which was its primary customer. SR Technics also performed maintenance for other SAirLines carriers and for third-party customers. Approximately 50 per cent of the total SR Technics work capacity was devoted to non-SAirGroup customers.

In April 2001, the parent holding company, SAirGroup, was renamed The Swissair Group. On 31 March 2002, Swissair ceased operations.

1.17.1.1 Swissair flight safety program

Swissair initiated a confidential reporting system in 1983; however, it was seldom used by the flight crews as a result of the establishment of a flight data analysis system that enabled the analysis of aircraft performance data. The information retrieved from the auxiliary data acquisition system (ADAS) was confidential and the analysis of this information was carried out by three selected Swissair pilots.

In each case, the Swissair analysts examined the data to determine how the aircraft was being flown, and to monitor any developing performance trends, such as out-of-tolerance flight parameters or deviations from standard operating procedures. As an example, they would monitor airspeeds to determine whether the speeds flown were within tolerances. The names of the pilots conducting the flights being analyzed were kept confidential. Only the relevant analysis was passed on to the Flight Safety department so that trends could be analyzed and addressed in newsletters or in simulator training. Each month a bulletin, entitled Incidents and Non-routine Occurrences, was published and distributed to the Swissair pilot community and also shared with other companies in the SAir Group. A quarterly safety letter, entitled Information Bulletin, was also distributed.

Pilot trust in this program was high. Each pilot at the company could request an analysis of the flights they had flown. It is estimated that at least 60 per cent of the case evaluations were pilot-requested.

1.17.1.2 Swissair postholder — Maintenance

Swissair was a scheduled airline operating under JAR-OPS 1 (see Section 1.17.2). As of 1 April 1998, Swissair was required, under JAR-OPS 1.175, to have nominated postholders^{Footnote 84} to be responsible for the management and supervision of the following areas:

• Flight operations;
• Maintenance system;
• Crew training; and
• Ground operations.

JAR-OPS 1.895 required an operator to employ a person, or group of persons, to ensure that all maintenance was carried out on time, and to an approved standard. The individual, or senior person in the group as appropriate, was the nominated postholder.

Swissair nominated the head of Flight Operations Engineering and Support to be responsible for its Postholder-Maintenance System. This position was responsible for protecting the interests of the airline regarding all maintenance, manufacturing, and service provider issues, and for being the primary point-of-contact within Swissair for all its maintenance providers. Other responsibilities included ensuring that the aircraft were airworthy and that the operational and emergency equipment was serviceable.

The Swissair Postholder-Maintenance System was also responsible for conducting routine monitoring of the maintenance activities performed by SR Technics. Some of the areas that required monitoring responsibilities in the Swissair Maintenance Management Exposition included

• performing audits with qualified auditors;
• submitting a written report, indicating the findings, required actions, responsibilities and deadlines for actions;
• submitting a copy of the report to the Quality Manager;
• storing the report for five years; and
• monitoring the implementation of the actions taken, and their effectiveness.

1.17.1.3 SR technics quality assurance program

At the time of the accident, SR Technics had a valid JAR-145 Maintenance Organization Approval issued by the FOCA. The Quality Assurance (QA) program was established in accordance with JAR 145.65 and was based on the requirements of the Euro/International Standard EN 29001/ISO 9001. The QA program covered all organizational requirements and activities related to quality. The QA program was designed to ensure that all work performed, and services rendered, were done in accordance with SR Technics policies, procedures, and instructions, and with standard industry maintenance practices.

The QA program also ensured compliance with applicable regulatory requirements. QA within SR Technics, particularly the airworthiness of the aircraft and the use of aircraft parts, was the responsibility of the individual production units, in accordance with relevant job descriptions and procedures. SR Technics took a "Total Quality Management" approach to QA; that is, individual employees were expected to be responsible for the quality of their own work, and were required to perform a self-inspection after each "work step." Depending on the nature of the maintenance procedure, additional inspections were required in accordance with the SR Technics Maintenance Organization Exposition. Unit supervisors were responsible for ensuring that their personnel were sufficiently trained and equipped to perform the task at hand, and for inspecting the quality of their employees' work. Random quality inspections were also performed by members of the SR Technics quality department.

1.17.1.4 SR technics reliability program

At the time of the occurrence, a reliability program was in place at SR Technics to ensure airworthiness and a high level of reliability to optimize economic operations. The program existed under the umbrella of a joint reliability program. The program was known as KSSU because it included the following operators: KLM, SAS, Swissair, Union de Transport Aeriens, and later Air France. The program was designed for use when performing maintenance on aircraft from the Swissair fleet or other customer airlines. The total maintenance program was based on the FAA Advisory Circular (AC) 120-17A. The KSSU reliability program was published in the SR Technics Engineering Handbook, Technik, and was valid for all aircraft types operated by Swissair.

Overall, reliability of the airframe, engines, and aircraft systems was subject to continuous monitoring and analysis, as required by JAR-OPS 1 Subpart M.

1.17.2 Swiss Federal Office for Civil Aviation

The regulatory agency responsible for aviation oversight^{Footnote 85} in Switzerland is the FOCA, an office of the Federal Department of the Environment, Transport, Energy, and Communication. Switzerland is a member state of the JAA. The CAAs of certain European countries have agreed to common, comprehensive and detailed aviation requirements (referred to as JARs). JAR-OPS, Part 1, prescribes requirements applicable to the operation of any civil aircraft for the purpose of commercial air transportation by any operator whose principal place of business is in a JAA member state. The requirements in JAR-OPS, Part 1, became applicable for Swissair on 1 April 1998. No information was found to indicate that Swissair was not in compliance with the JARs at the time of the occurrence.

After 1 April 1998, the FOCA adopted the JAA philosophy that because of "increasing complexity and scale of both aircraft and commercial operations, the traditional spot checks undertaken by authorities no longer provide an intelligible or complete picture of any but the smallest operations."^{Footnote 86} Under the provisions of the JARs, the airline has a share of the responsibility for monitoring the quality of a safe service to the public. Important to the effectiveness of the policy is the JAR-OPS requirement for the establishment, by the operator, of a Quality System. This involves a designated Quality Manager and a nominated Accountable Manager; Swissair established such an organization.

Prior to the occurrence, the FOCA informally monitored Swissair operations, but did not conduct formal operational audits. The inspector responsible for monitoring Swissair was a former Airbus A310 captain. At the time of the occurrence, there were four operations inspectors within the Flight Operations Section of the FOCA, and all four had some dealings with Swissair.

Swissair flight operations were monitored by the FOCA through semi-annual coordination meetings, and by reviewing the daily flight operations report, flight safety reports, and crew reports of unusual incidents. The results of the Swissair Flight Operations QA program and ADAS analysis were also forwarded to the FOCA.

The responsibility for check rides was delegated to designated check pilots at Swissair; these rides were performed in accordance with the Quality System. Therefore, FOCA inspectors did not perform check rides on Swissair pilots, although they did periodically ride in the cockpit on scheduled Swissair flights to monitor in-flight operations. On the basis of their monitoring, the FOCA indicated no concerns about Swissair's flight operations.

1.17.3 Federal Aviation Administration

As the state of manufacture, the FAA was responsible for the original design approval of the MD-11 aircraft. The FAA accomplished this through a partnership process with the aircraft manufacturer, which resulted in the issuance of the type certificate number A22WE. After an aircraft is in service, the regulator provides management of the type certificate in a manner consistent with FAA policy and FAR requirements. The responsible Aircraft Certification Office maintains oversight by directly liaising with the type certificate holder on matters of continuing airworthiness.

1.17.4 The Boeing company

Boeing, and its predecessor McDonnell Douglas, as the holder of the MD-11 type certificate, is responsible for the continuing airworthiness activities associated with the MD-11 aircraft. These activities include the following:

• Completing the applicable Instructions for Continued Airworthiness (ICA);
• Participating in the Service Difficulty Reporting system as specified in 14 Code of Federal Regulations (CFR) 21.3;
• Providing necessary design changes to correct unsafe conditions as specified in 14 CFR 21.99; and
• Assisting in the development of ADs and coordination of safety issues with the appropriate FAA office.

1.18 Other relevant information

This section provides a variety of relevant information about the SR 111 occurrence that is not described in other sections of this report.

1.18.1 Swissair training

1.18.1.1 Flight crew

1.18.1.1.1 Aircraft training

Swissair pilots who transition to the MD-11 from other company aircraft were required to complete Swissair's standard six-week training course. The Swissair syllabus was adopted from the McDonnell Douglas, FAA-approved course. On these courses, captains and first officers were trained together, and there was a focus on the need to operate together as a crew.

As well as being trained to follow specific checklist procedures appropriate to the type of emergency, Swissair flight crews were trained to react to an emergency situation according to the following philosophy: Power, Performance, Analysis, Action. This sequence was designed to ensure the aircraft is configured appropriately, the situation is properly assessed from all perspectives, proper priorities are established, and appropriate outside resources are used as necessary.

1.18.1.1.2 Smoke/fumes/fire training

During the Swissair standard six-week pilot training course for transitioning to the MD-11, procedures for smoke/fumes/fire were covered in classroom discussions and in simulator training. Pilots were instructed to don their full-face oxygen masks at the first sign of smoke because of the danger of inhaling toxic fumes. Donning the oxygen masks was considered a memory item; therefore, it was not included as an item in the written checklist. The decision about whether to commence an emergency descent was considered a flight crew judgment call based on their perception of the threat. Initiating an emergency descent was also considered a memory item and was not included in the written checklist.

The flight crews were taught to evaluate any emergency situation before starting a checklist. For smoke/fumes events, flight crews were taught that unless they were certain that the source of smoke/fumes was the air conditioning system, they were to use the Smoke/Fumes of Unknown Origin checklist (see Appendix C–Swissair Smoke/Fumes of Unknown Origin Checklist). If flight crews were certain that the source of smoke/fumes was the air conditioning system, they could use the Air Conditioning Smoke checklist (see Appendix B–Swissair Air Conditioning Smoke Checklist).

A decision about whether to initiate a diversion for a precautionary or emergency landing was to be based on best judgment, with consideration given to the nature of the perceived threat. The company General/Basics Flight Crew Manual stated the following:

If a flight cannot be made to the regular destination, a diversion must be made to the most suitable alternate aerodrome providing the best available operational and passenger handling service.

To best meet this stipulation, the first choice would be an airport with a Swissair or contracted handling agent, such as Boston. Halifax was also a suitable, approved en route airport for the diversion of Swissair MD-11s.

The General/Basics manual also stipulated the various conditions that would require the flight crew to land at the nearest emergency aerodrome. These conditions included the following fire- or smoke-related scenarios:

• Any fire on board an aeroplane, including engine fire, if firefighting is not possible or ineffective; or
• Persistent smoke of unknown origin.

The General/Basics manual defined an emergency aerodrome in the following way:

Emergency aerodrome in this context means an aerodrome where a safe landing for the respective type of aeroplane in the configuration can be made, disregarding repair facilities, or passenger handling, etc.

At Swissair, and throughout the aviation industry, it was generally accepted that human sensory perception can be used to help differentiate between air conditioning and electrical smoke/fumes. For example, smoke/fumes from an electrical event would be expected to be acrid, and cause irritation to the eyes and respiratory tract. This information might be supplemented by looking for other potential clues about the source of the smoke, such as the colour, intensity, and the location from which the smoke/fumes are emanating, and any associated aircraft system anomalies.

The human sense of smell is the most rudimentary and least understood of all the human senses, and the experience of various smells is a subjective phenomenon. Although the threshold concentrations required to detect many substances through smell are low,^{Footnote 87} humans are generally not good at identifying the specific source of a smell.^{Footnote 88} Although ability to identify odours has been shown to be augmented by other characteristics of the source of the odour (e.g., irritation, acridity, pungence),^{Footnote 89} this is unlikely to assist a crew in distinguishing between different types of smoke that are quite similar in this regard. In addition, an individual's ability to discriminate between odours has been shown to be affected by attentiveness, temporary medical states such as congestion, and temporary physical states such as hunger.^{Footnote 90} The odour and smoke that appeared in the SR 111 cockpit consisted of the by-products of combustion, but the limited cues available were perceived by the pilots as pointing to an air conditioning source.

Training for the use of the Smoke/Fumes of Unknown Origin Checklist was conducted in the simulator. During MD-11 transition training, all three positions of the SMOKE ELEC/AIR selector are exercised. Flight crews were required to examine which aircraft systems were and were not available at each selector position. Flight crews were instructed that it takes about five minutes to exchange 100 per cent of the air in the aircraft. This was intended to provide guidance regarding how long it might take to assess whether the selection of a particular position was leading to the dissipation of the smoke/fumes. The information about the air exchange time was not written in any manuals or checklists, including those supplied by the manufacturer.

One simulator training session involved a scenario in which a "smoke of unknown origin" emergency occurred on take-off. The flight crew was expected to follow the Smoke/Fumes of Unknown Origin Checklist and to use the SMOKE ELEC/AIR selector. To save simulator time, the simulated smoke was terminated when the pilots selected the first position of the selector. As was the industry norm, there was no simulator training for an ongoing fire. Therefore, the pilots were not exposed to the combination of fire-related effects, such as a deteriorating cockpit environment with decreased instrumentation. The same simulator session also included an uncontrolled cargo fire scenario. The flight crews were expected to complete an emergency descent, followed by a landing and evacuation.

No specific training was provided for locating and suppressing fires in the cockpit or avionics compartment. Such training was not required by regulations, nor was it common industry practice to provide it.

No specific training was provided on flying the aircraft using only the standby instruments; there is also no regulatory requirement for such training. Several operators of transport category aircraft were canvassed to determine whether they provided this training to their pilots; none did.

Consistent with industry norms, there was no specific training on the location of potential flammable material in the aircraft, specifically in the hidden areas. The absence of such training reflected the lack of knowledge within the industry about the presence of materials used in the construction of the aircraft that, although certified for use, could be ignited and propagate flame.

1.18.1.1.3 Back-course approaches

Although the FMS database in the MD-11 does not store approach guidance information for back-course approaches, this would not have precluded the SR 111 pilots from conducting a back-course instrument approach using autopilot tracking methods, or conducting an NDB approach to Runway 06 for which data is stored in the MD-11 FMS database.

Because Swissair crews flew scheduled flights into airports equipped with back-course approaches, procedures existed, and flight crews were trained, for conducting non-FMS back-course approaches. Swissair MD-11 flight crews are trained, as part of their simulator training program, to conduct back-course approaches into Dorval Airport in Montréal, Quebec. The first officer had received this training within the previous six months; the captain, being a qualified simulator instructor, was also familiar with back-course approaches.

To conduct any approach, the pilots would want to know detailed approach procedure information, which is normally obtained from a hard-copy approach chart. Alternatively, if the situation warranted, sufficient partial information could also be obtained by asking the ATS controller for specific information. When flying a back-course approach in the MD-11, the autopilot can be used to fly the approach in the track mode; however, the pilots use track mode and heading mode constantly in training and in line operations. Therefore, flying a back-course approach would require more flight crew input and constitute a higher crew workload than is involved in conducting FMS-directed instrument approaches for which information is provided in the MD-11 FMC database. Some MD-11 operators have decided not to establish procedures for back-course approaches.

1.18.1.1.4 Fuel dumping

One simulator training session included an engine fire scenario that involved fuel dumping. As is normal industry practice, Swissair instructs its pilots that fuel dumping can be handled in two ways depending on the urgency: if the aircraft is in an emergency situation, fuel dumping can be initiated immediately and continued until shortly before landing; or if the situation and time permits, the aircraft can be flown to a designated fuel dumping area.

1.18.1.2 Flight attendant training

All of the flight attendants on board SR 111 were trained in accordance with the approved Swissair training requirements that were based on, and in accordance with, the JAR OPS. This training included initial and recurrent training on firefighting. The syllabus for the training included the importance of identifying the source of a fire, location and handling of firefighting equipment, communicating with the cockpit, firefighting responsibilities, and proper techniques for firefighting including use of fire extinguishers.

There was no specific training regarding firefighting in the attic area, nor was there any training specific to accessing other areas within the pressurized portions of the aircraft that are not readily accessible. There was also no specific training provided to the cabin crew about fighting a fire in the cockpit. This was consistent with government regulations and industry standards.

1.18.1.3 Human factors training

Swissair provided human factors training, commonly referred to as cockpit (or crew) resource management (CRM), to flight crew and cabin crew. The training for the flight crew consisted of a biennial, two-day course. The cabin crew received a two-day course as part of the initial cabin crew training program; then during the yearly cabin crew recurrent training, one and a half hours were reserved for CRM. Prior to 1997, this course was taught separately to flight crews and cabin crews. In 1997, Swissair began including the M/C in the flight crew training for one of the days. Course topics include the following:

• Communication;
• Conflict resolution; and
• Behaviour in emergencies.

In addition to the formal human factors training flight crews receive, Swissair employs a staff psychologist who is available for both flight and cabin crew to deal with personal matters or for any additional human factors information.

See the supporting technical information on this topic.

1.18.2 Swissair checklists for in-flight firefighting

1.18.2.1 General

For emergency procedures, each pilot had available in the cockpit, a book of checklists entitled Emergency Checklist Alert and Non-alert. The following three flight crew checklists dealt specifically with smoke or fumes:

1. Air Conditioning Smoke (see Appendix B–Swissair Air Conditioning Smoke Checklist);
2. Smoke/Fumes of Unknown Origin (see Appendix C–Swissair Smoke/Fumes of Unknown Origin Checklist); and
3. Smoke/Fumes Removal.

For smoke and fire emergencies, checklist procedures were available for the cabin crew in the Cabin Emergency Preparation/Evacuation Checklist. These procedures were entitled "Smoke On Board" and "Fire On Board."

See the supporting technical information on this topic.

1.18.2.2 Flight crew smoke/fumes checklists

The MD-11 was certified with the following three flight crew checklists for identifying and dealing with smoke/fumes: Air Conditioning Smoke; Smoke/Fumes of Unknown Origin; and Smoke/Fumes Removal. The aircraft manufacturer recommended that the Air Conditioning Smoke checklist be used only when a flight crew was certain that the air conditioning system was the source of smoke or fumes.

In March 1993, the aircraft manufacturer removed the Air Conditioning Smoke Checklist from the Flight Crew Operating Manual (FCOM), although it was retained in the FAA-approved Airplane Flight Manual (AFM). The Smoke/Fumes of Unknown Origin Checklist was renamed to the Smoke/Fumes of Electrical, Air Conditioning, or Unknown Origin Checklist. The amendment was based on the logic that the same steps were included in the Smoke/Fumes of Unknown Origin Checklist; therefore, regardless of the source, the same action items could be used to attempt to isolate the source of the smoke/fumes.

Swissair developed its MD-11 checklists based on the FAA-approved AFM. When the aircraft manufacturer reduced to one smoke/fumes checklist in the FCOM, some airline operators including Swissair, decided to keep the two separate checklists. The Swissair decision to keep the two checklists was based on the view that if a flight crew could determine, with 100 per cent certainty, that the air conditioning system was the source of smoke/fumes, the Air Conditioning Smoke checklist would be used and there would be no associated disruption to the aircraft electrical system. Swissair considered this to be the safest alternative, because when the Smoke/Fumes of Unknown Origin Checklist is actioned, electrical power and pneumatics are removed from a number of services (see Appendix C), making it more demanding to fly the aircraft.

1.18.2.3 Swissair MD-11 checklist design

1.18.2.3.1 Philosophy and methodology

The source document for MD-11 checklists used by Swissair crews is the Swissair MD-11 AOM. This manual, developed by Swissair, describes the MD-11 aircraft systems and normal, abnormal, and emergency operating procedures. The AOM was derived from the FAA-approved AFM, the McDonnell Douglas MD-11 FCOM and Swissair's company policies. Revisions to the AOM were issued to manual holders as required from time to time and distributed by means of a consecutively numbered "Transmittal Letter." AOM bulletins were periodically published to inform manual holders of technical/operational matters related to the AOM including checklist revisions. The AOM and revisions were submitted to the FOCA for review; checklist revisions are not required by the JARs to be approved by the FOCA. AOM bulletins are submitted to the FOCA for information only.

Swissair's checklist design philosophy considered ease of use, accessibility, brevity, and similarity in groupings. Checklists were to be designed to be simple in presentation, especially those pertaining to emergency situations, and were to be quickly and easily accessible by the flight crew. Each procedure, from start to finish, was to be designed to be contained on one page; procedures having common themes were grouped together.

Swissair maintained a close relationship with the manufacturer concerning checklist design. They met regularly to discuss such matters as potential checklist changes and problems noted with checklist usage during simulator sessions; however, the manufacturer does not approve the checklists used by the operators.

1.18.2.3.2 Comparison with guidelines

An FAA document entitled Human Performance Considerations in the Use and Design of Aircraft Checklists was published in 1995 to assist FAR Part 121 and 135 operators in the design, development, and use of cockpit checklists, and to increase their awareness of human performance issues relating to checklist usage. The CAA in the United Kingdom has a similar set of guidelines, entitled Guidelines for the Design and Presentation of Emergency and Abnormal Checklists.

Although these guidelines were not in effect during the MD-11 design period, they were available for reference during ongoing checklist modifications. As part of the SR 111 investigation, the guidelines were used to evaluate the Swissair emergency checklist dealing with smoke/fumes.

Deviations from the guidelines were noted. While the one-page principle is appropriate in general, its application for the Smoke/Fumes of Unknown Origin Checklist conflicted with other design principles. For example, attempts to condense this checklist onto one page led to the use of smaller-than-recommended font sizes in the notes section.

1.18.3 Availability of published approach charts

Published approach charts provide the flight crew with information, such as runway orientation, length and lighting, minimum safety altitudes and descent altitudes, names, identification letters and frequencies of navigation aids, radio frequencies, and headings to be flown. This information is used when entering the airspace surrounding an airport when conducting an instrument approach.

As with many operators, the Swissair procedure for the MD-11 was to carry a set of airport approach charts in a crew bag that was stored in the ship's library at the rear of the cockpit. It was not possible for either pilot to reach the bag while seated; therefore, a pilot would either have to leave the seat or request a cabin crew member to come forward to relocate the bag. In a normal situation, little risk is associated with these options; however, in an abnormal or emergency situation, this extra task constitutes a distraction that can cost valuable time.

1.18.4 Wire-related issues

1.18.4.1 Wire separation issues

1.18.4.1.1 General

In the MD-11, the overhead CB panel contains six electrical buses that supply power to many of the aircraft's systems: four emergency buses, the battery bus, and the battery direct bus. The battery direct and the battery bus feeds are routed together, making five separate cable runs into the cockpit overhead panel from the avionics compartment. The five cable runs are spatially separated from each other until they reach an area approximately 31 to 46 cm (12 to 18 inches) aft of the housing that is located behind the overhead CB panel. They are then bundled together and enter the overhead CB panel through an oval opening on the right aft side of the housing.

One of the emergency bus feed power cables found in the wreckage, identified as a section of the left emergency AC bus feed, exhibited an area of melted copper consistent with an arcing event in a location between 10 and 15 cm (3.9 and 5.9 inches) outside the housing. This particular cable was insulated with BXS7008, a XL-ETFE type insulation, whereas the remaining cables were constructed from BXS7007, a polyimide-wrapped film and a meta-aramid fibre paper outer cover. This general area above the cockpit had experienced heat damage from the in-flight fire. Other wires from the same general location, but in a different wire bundle, were also found to have arced. As indicated in Section 1.18.8 of this report, the known sequence of events does not support the hypothesis that the arcing of the wires in this area was related to the initiating event. That is, the arcing in this area took place later in the failure sequence and was the result of fire-related heat damage to the wires.

The left emergency AC bus lost power shortly before the flight recorders stopped recording. It is unknown whether any or all of the remaining emergency or battery buses were eventually affected, but it is known that none of them were affected at the same time as the left emergency AC bus. However, because the cables were brought into such close proximity in the overhead panel housing area, they would all have been exposed to the same threat, such as heat, fire or arcing event.

1.18.4.1.2 Consequences of a total loss of electrical power to the overhead panel

It could not be determined whether power sources other than the left emergency AC bus were lost to the overhead panel; however, an assessment was completed to determine the effect on aircraft systems if a total loss of electrical power occurred. Because it was known that primary electrical power was still available until the time of impact, the assessment focused on determining what functions would remain available from primary power sources to provide basic information, such as attitude, altitude, airspeed, and heading. The primary flight controls do not require any electrical power to operate and so were not part of this assessment.

DU 2 would remain powered from primary power and would be reconfigured to a PFD with DEU 3 providing the inputs. The PFD would provide attitude and heading information. Altitude and airspeed would be available from the standby instrument. Engine control would be available, but no engine and alert status information would be available. All radio communication would be lost. Numerous other warning lights, such as the master warning and caution lights, would not be functional.

1.18.4.1.3 Regulatory requirements

The MD-11 wire installation design was assessed as part of the investigation to determine whether it met the regulatory requirements for wire separation, and whether there were any associated safety deficiencies.

The following FARs relate to wire separation and routing:

1. FAR 25.1309(b) states that failure analysis must consider that "no single failure shall prevent safe flight and landing";
2. FAR 25.903(d) states that turbine engine installation design must minimize hazards to wires in case of rotor failure;
3. FAR 25.631 requires that wiring, necessary for continued safe flight and landing, must be protected against a bird strike hazard; and
4. FAR 25.1353(b) deals with the separation of essential system wiring and heavy current-carrying cables.

Specifically, this assessment focused on the area where the power cables are bundled together just before they enter into the overhead switch panel housing. This bundle was in close proximity to hundreds of other circuit wires that were also bundled together as they entered or exited the housing. When assessing the MD-11 overhead panel housing area, the most relevant regulation is FAR 25.1353(b), which states "Cables must be grouped, routed and spaced so that damage to essential circuits will be minimized if there are faults in heavy current-carrying cables." This requirement calls for the spatial separation of cables to avoid damage to essential circuits. Essential loads, as defined by the MD-11 manufacturer, are those that are essential to maintain controlled flight in zero visibility.^{Footnote 91} The regulation requires that a potential threat be minimized; it does not require that a potential threat be eliminated. The term "minimized" is not defined; however, according to the FAA, the term has an element of reasonableness associated with it.

To meet the requirement of FAR 25.1353(b), the electrical cables in the MD-11 that run to the overhead panel are spatially separated from each other until they enter the overhead panel housing. Once the cables were positioned together, spatial separation no longer existed. To minimize the risk of wire insulation chafing, the manufacturer fitted the edge of the oval opening in the housing with a nylon grommet. For added mechanical protection, the cables that are between 8 AWG and 00 AWG in size are protected by an extra (third) wrap of polyimide insulation, plus an outer jacket (meta-aramid fibre paper). The wires between 24 AWG and 10 AWG have two wraps of polyimide insulation. The three right emergency AC bus cables were also wrapped in a silicone elastomer-coated glass fibre braided electrical sleeving to provide additional protection. The additional mechanical protection provided on the cables in the bundled area met the FAA's interpretation of minimization and reasonableness. Because of the lack of specific quantitative information in the guidance material, it could not be determined what criteria was used to determine the level of mechanical protection needed to satisfy the requirements of FAR 25.1353(b) for situations where adequate spatial separation is impracticable.

The design of the MD-11 wire routing into the overhead switch panel housing was based on the design used in the DC-10. The service histories of both aircraft were reviewed to determine whether any problems, such as chafing, were reported; none were found.

1.18.4.1.4 Mixing of wire insulations

The predominant general wire insulation used on the occurrence aircraft was the MIL-W-81381, polyimide-film-type wire insulation. However, other types of insulations were also used depending upon requirements. Wires with these different insulation types were sometimes routed in the same wire bundles. While there are no regulations pertaining to the mixing of wire insulations with dissimilar properties, FAA ACs 25-16 and 43.13-1B provide guidance. These guidelines rely on the aircraft manufacturer or subsequent modifier to establish the compatibility of various wire insulation materials through satisfactory in-service performance history, additional tests, or both.

When the DC-10 entered revenue service over 25 years ago, some problems were encountered with the premature failure of clamps and wires at clamping points in areas of high vibration (pylons, wing, and tail engine). The MD-11 manufacturer developed a wire compatibility test procedure to represent the most severe vibration environment on the aircraft that replicated the failures experienced on in-service aircraft. Testing allowed the MD-11 manufacturer to assess the compatibility of various wire insulations, to evaluate new wire insulation types, and to develop containment parts (clamps, nylon tie-wraps, etc.) and materials including protective sleeving and tubing. The MD-11 manufacturer advises that high vibration and wire-to-wire abrasion testing has shown that, when properly installed, the mixing of different approved insulation types has not been a problem.^{Footnote 92} Typically, it was found that the wear patterns are similar regardless of whether there is a mix of insulations. The wire compatibility test developed by the MD-11 manufacturer has become their standard for evaluating and developing new wire insulation types, containment parts and materials, and protective sleeving and tubing. In addition, the FAA has indicated that there is no systemic problem associated with the use of mixed wire types that are properly installed and maintained.

1.18.5 Circuit protection devices

1.18.5.1 General

A regulatory requirement exists that electrical wires and cables be protected from an over-current condition.^{Footnote 93} Typically, a circuit protection device (CPD) is used to provide this defence. CPDs are designed to protect the wire or cable; that is, they are not designed to protect the associated electrical components, such as line replaceable units (LRU), which may require their own internal CPDs.

1.18.5.2 Circuit breaker design

The majority of CPDs used in aerospace applications are the resettable thermal CB type developed as a replacement for fuses. These conventional CBs typically contain a circuit consisting of a bimetallic element and two electrical contacts, one of which is spring-loaded. When an over-current condition occurs, the circuit heats as a function of current flow and time. When the heat exceeds a preset amount, the bimetallic element bends causing the spring-loaded contact to trip and open the circuit. The design is known as a "trip-free" CB in that it cannot be reset in the presence of an over-current condition. After a predetermined interval for cooling, the CB is capable of being manually reset.

This type of CB has proven to be effective in accomplishing its primary role, which is to protect wire and cable from damage owing to an over-current condition. Specifically, this type of CB successfully protects the circuit when the temperature and time duration characteristics of the over-current condition are within the CB's design limits.

However, some types of wire and cable failures involve arc faults. Arc faults can create circumstances that do not fall within the design limits of the over-current/time protection curve of conventional CBs. One such phenomenon is an intermittent metal-to-metal event (conductor-to-conductor or conductor-to-frame) known as a "ticking fault." Such events can generate extremely high temperatures at the location of the insulation failure; however, the current draw may not be sufficient to heat the bimetal element to the temperature necessary to cause the CB to trip. In some cases, a breakdown of wire insulation can lead to other types of arc fault failures, such as arc tracking. The arc-tracking phenomenon involves carbonization of the wire insulation material that can result in intermittent arc faults between conductors, the aircraft frame, or other grounded conducting material.

Although the hazards created by ticking faults and electrical arc tracking are widely known, existing technology is such that there are no CPDs available for use in aircraft that can accurately and reliably detect faults associated with wire insulation breakdown. The USN, the FAA, and aircraft manufacturers are sponsoring initiatives to address this shortfall in CPD technology. The goal is to develop an arc fault circuit breaker device appropriate for aircraft use.

See the supporting technical information on this topic.

1.18.5.3 Circuit breaker reset philosophy

Inconsistencies exist within the aviation industry regarding CB reset philosophies, which have resulted in the evolution of inappropriate CB reset practices. For example, there is a widely held view among flight crew and maintenance personnel that one reset of any tripped CB is acceptable. Consequently, often the first step in troubleshooting a tripped CB was a reset attempt. There is also a view that the reset of a low ampere CB is less dangerous than the reset of a higher ampere CB. However, while the consequences of resetting a low ampere CB may be less pronounced, under the correct conditions an arcing event involving a low ampere circuit could readily ignite a fire. Since it is impossible to know whether these conditions exist in any given situation, a tripped CB should not be reset before any associated fault is located and eliminated.

The adverse consequences of a CB reset may not be universally well understood within the aviation industry. An inappropriate reset can exacerbate the consequences of the initial fault and lead to an arc or arc-tracking event; however, there is no clear regulatory direction to the industry on the issue of CB resets. In AC 25.16, the FAA recommends that all AFMs should contain guidance that states the following:

The crew should make only one attempt to restore an automatically-disconnected power source or reset or replace an automatically-disconnected CPD that affects flight operations or safety.

Precisely what action is expected from this statement is open to interpretation. In addition, there is no regulatory requirement that the AFMs are to inform flight crews of the adverse consequences of CB resets, or to state categorically that no resets are allowed except for a single reset of those systems deemed by the pilot-in-command to be flight essential.

Likewise, the FAA guidance material for maintenance personnel does not address the issue of resetting of tripped CBs. The FAA AC 43.13-1B does refer to the SAE Aerospace Recommended Practice (ARP) 1199, which deals with over-current protective devices. This ARP does not specifically discuss the immediate consequences of resetting CBs; however, it does advise that CBs should not be allowed to develop a "history of tripping."

In 1999, the major aircraft manufacturers summarized their existing CB reset policies by issuing statements to all operators that give clear and unambiguous direction concerning CB resets. However, operators are under no obligation to act on manufacturer recommendations; they are only required to act on requirements imposed by regulators.

Subsequently, on 21 August 2000, the FAA issued a Joint Flight Standards Information Bulletin entitled Resetting Tripped Circuit Breakers in an effort to standardize the industry's approach to this issue. The goal of the bulletin was to ensure that air carriers had training programs and manuals in place for flight crews, maintenance personnel, and aircraft ground servicing personnel, and that these programs and manuals contained company policies and procedures for resetting tripped CBs that reflected the FAA's position on this issue. This bulletin was only applicable to air carriers in scheduled operation, with aircraft having a passenger-seat configuration of 10 or more seats, or a payload capacity of more than 7 500 lb. This bulletin's expiration date was 31 October 2001.

1.18.5.4 Circuit breakers used as switches

The use of CBs as switches, either by design, or as a consequence of the system's in-service performance, is not recommended. The FAA guidance on this issue is contained in AC 43.13-1B and states "Circuit breakers...are not recommended for use as switches. Use of the circuit breaker as a switch will decrease the life of the circuit breaker."

SAE ARP 1199 expands on the guidance:

• CBs are designed for a different purpose and have a life of 1/10th or less of the life of a switch;
• CBs are not to be considered substitutes for switches;
• Excessive manual operation of a CB can cause dynamic wear of the breaker latching areas and pivotal points; and
• Using a CB as a switch can cause its contacts to arc, thereby pitting the contacts and generating EMI.

As there are no regulatory restrictions preventing the use of CBs as switches, it appears that this guidance is provided as a means to enhance system reliability as opposed to establishing the minimum requirements for system safety.

As certified, and installed on the occurrence aircraft, the original IFEN system design did not incorporate an ON/OFF master switch. The ON/OFF capability was achieved by the installation of the 28 V DC Interactive Flight Technologies (IFT)/video entertainment system 28 V CB. Although it was determined that this configuration was not related to the initiation of the fire, it did have the potential to be problematic, as suggested in the guidance material in the SAE ARP 1199. As modern aircraft use more software-based equipment, it is not uncommon for systems to be designed in this manner. CBs are being used more frequently as switches, as they are viewed as a convenient method of "rebooting" the system when the software gets "hung up."

Although no particular unsafe conditions were validated during the investigation regarding the use of CBs as switches, questions remain concerning the practice, including the potential for frequent "switching" to induce a change in the physical properties of the CB so as to alter its reaction time in the face of an over-current condition. The routine use of a CB as a switch also has the potential to influence an individual's perception about the actual use and function of a CB.

1.18.5.5 Circuit breaker maintenance

The CB is known in the aviation community to be a simple, long lasting, and reliable component that is designed to provide protection for the aircraft's wires and cables throughout the life of the aircraft. Due in part to its dependability, CB maintenance is usually confined to the replacement of a failed CB.

Typical CB failure modes include welding, erosion of electrical contacts, and contamination.

In addition, the mechanical characteristics of the CB will change when a CB trip mechanism has been inactive for long periods. Such changes could lead to inappropriate performance during an over-current condition, resulting in inadequate protection of the circuit. Routine inspections, including the unpowered cycling of the CB mechanism, can be useful in ensuring the reliability of a CB. Such cycling serves to enhance CB performance by "exercising" the CB trip mechanism and cleaning contaminants from the contact surfaces. Both the FAA and SAE recommend this practice to enhance CB reliability.^{Footnote 94}

1.18.6 High-intensity radiated fields

1.18.6.1 General

Modern aircraft transmit and receive RF signals in the atmosphere external to the aircraft. In addition, RF signals are conducted and radiated within the aircraft, through electrical cabling, to control and communicate with various electronic systems. High-intensity radiated fields (HIRF), produced by powerful radar transmitters or lightning, will partially penetrate a commercial aircraft through apertures in the aircraft's hull.^{Footnote 95} HIRF may couple onto cabling within the aircraft structure and distort or corrupt the signals carried on these cables, thereby disrupting the normal functions of the associated aircraft systems. In addition, if the HIRF gradient within the pressurized area of the aircraft exceeds 23 kilovolts per centimetre, an electrical discharge may be induced between narrowly separated conductors.^{Footnote 96} In this latter case, physical damage to electrical components may occur and flammable materials in the surrounding area may ignite. The HIRF environment in the vicinity of the occurrence aircraft was studied to determine whether the ambient field strength was sufficient to produce such an effect.

1.18.6.2 JFK international airport environment

An assessment of the HIRF environment at JFK International Airport was derived from a 1998 study^{Footnote 97} of the peak and average field intensities to which aircraft operating in US civil airspace could be exposed. During normal approach and departure operations in the airspace on and around airports, a peak field strength of 3 kilovolts per metre can occur in the 2 to 6 gigahertz (GHz) frequency band.

1.18.6.3 En route environment

For the en route portion of the occurrence flight, the most significant known HIRF environment was produced by an AN/FPS-117 air route surveillance radar, located near Barrington, Nova Scotia. At 0109, the occurrence aircraft passed within 10 nm of this radar site at an elevation angle of approximately 30 degrees from the horizontal. A maximum field strength of 20 volts per minute (V/m) can be produced by the Barrington radar, at a slant range of approximately 10.5 nm. However, because this radar is optimized to achieve optimum gain at relatively low elevation angles, a field strength of approximately 4.3 V/m was produced by the Barrington radar in the external environment surrounding the occurrence aircraft. A maximum combined field strength of approximately 12.1 V/m was produced by the Barrington radar and all other background emitters in the external environment surrounding the occurrence aircraft.

1.18.6.4 Theoretical worst-case HIRF environment

An estimate of the most severe HIRF environment, during any phase of flight, was developed for airspace where fixed-wing commercial operations are permitted. Field strengths were calculated for surface emitters and airborne intercept radars, operating at the minimum separation distances permitted under instrument flight rules. Mobile and experimental transmitters, and transmitters located inside restricted, prohibited, and danger areas, were not considered. This methodology produced a worst-case peak field strength of 7 200 V/m, which is assessed to occur in the 4 to 6 GHz frequency band.

1.18.6.5 MD-11 HIRF certification environment

The MD-11 aircraft certification was subject to special HIRF test conditions imposed by the FAA and the JAA. Test procedures were specified for the MD-11 to demonstrate an acceptable level of aircraft systems protection from the effects of HIRF. The MD-11 HIRF test environment was more stringent than the HIRF certification guidance that currently exists for new aircraft, and exceeded the theoretical worst-case environment. For example, in the 4 to 6 GHz band, where the highest theoretical field strengths are assessed to exist, the MD-11 test condition specified a peak field strength of 14 500 V/m, about double the peak field strength of the theoretical worst case. In the 1 to 2 GHz frequency band, where the Barrington radar operates, the MD-11 test condition specified a peak field strength of 9 000 V/m.

1.18.6.6 Effect of HIRF on VHF communications

Aircraft antennas are designed to receive RF signal energy in specific frequency ranges and to conduct this RF energy to the radio or radar receivers in the aircraft. Aircraft radios are designed for operation at frequencies assigned in accordance with national and international RF spectrum allocations. These RF spectrum allocations are developed to ensure that authorized high-power RF sources will not interfere with aircraft radios and radars. If a HIRF source were to operate within the assigned frequency range for an aircraft radio, the HIRF energy within the frequency range to which the radio receiver was tuned would be demodulated and amplified, adversely affecting VHF communications. However, modern radio receivers are designed to prevent radio signals from being amplified to unsafe power levels. In general, there is no relationship between the degradation or disruption of VHF communications owing to EMI, and the presence of field strengths sufficient to induce an electrical discharge between proximate conductors. The service record for Douglas commercial aeroplanes does not contain any instances of HIRF-induced degradation or disruption of VHF communications, or the presence of field strengths sufficient to induce electrical discharges between proximate conductors.

1.18.6.7 Effect of resonance on HIRF energy

When a travelling wave is reflected back upon itself, the incident and reflected wave energy may combine to form a spatially stationary, reinforced wave. For an electromagnetic waveform, such as HIRFs, reinforced wave phenomena or resonance can occur in closed cavities, along a length of wire or around the perimeter of an aperture. When resonant conditions exist, the energy density of the reinforced wave may be up to 25 times greater than the energy density of the incident wave. In practice, resonant gain factors rarely exceed a single order of magnitude.

See the supporting technical information on this topic.

1.18.7 In-flight entertainment network

1.18.7.1 General

In May 1996, Swissair entered into an agreement with IFT to install a then state-of-the-art IFEN system into 16 MD-11 and 5 B-747 Swissair aircraft. The installations were to be completed under the authority of Switzerland's FOCA, and in accordance with the FAA STC ST00236LA-D

See the supporting technical information on this topic.

1.18.7.2 IFEN installation–Roles and responsibilities

In the agreement made with Swissair, IFT was responsible for all aspects of integrating the IFEN system into all Swissair MD-11 and B-747 aircraft, including the system-to-aircraft integration design, system certification, hardware installation, ongoing support, training, and continuing airworthiness.

IFT specialized in the design and manufacture of the IFEN system components. To complete the installation project, IFT required the services of others who had expertise in integrating an IFEN into an aircraft design, certifying the system, and installing the system components into the aircraft.

IFT entered into an agreement with HI to perform the IFEN certification, system-to-aircraft integration engineering, and aircraft installation functions. These subcontracted aspects included the development of all necessary engineering drawings and documents and the manufacturing of wire bundles, equipment racks, and structural supports. Under the contract HI was responsible for the hardware installation of the system into all Swissair MD-11 and B-747 aircraft. The installation work was to be done at SR Technics facilities in Zurich, Switzerland.^{Footnote 98}

HI entered into an agreement with Santa Barbara Aerospace (SBA) to perform the FAA certification services, in its capacity as an FAA-approved Designated Alteration Station (DAS). By agreement with HI and IFT, SBA became the owner of STC ST00236LA-D and became responsible for complying with all regulatory requirements, including continued airworthiness.

In certifying the STC, SBA had been delegated the authority (by the FAA) to act on behalf of the FAA. FAA procedures required that a DAS submit a Letter of Intent (LOI) for each STC project, describing the project in sufficient detail to allow the FAA to determine what level of FAA involvement and oversight would be appropriate.^{Footnote 99}

The Swiss FOCA accepted that an FAA-approved STC could be used for the project. Its acceptance was based on the installation work being accomplished by HI personnel and performed under the provisions of the European JAR 145-approved QA program at SR Technics. In addition, HI was required to submit FAA Form 337^{Footnote 100} to SR Technics, documenting that the system was installed in accordance with the certification requirements of STC ST00236LA-D, and the FAR, Part 43. The Swiss FOCA did not assume any direct responsibility for authorizing or overseeing the IFEN installation project.

SR Technics' function in the Swissair IFEN project was governed by its contract with Swissair, known as the "September 1996 Offer," and by its responsibilities in accordance with its role as the JAR 145 maintenance provider for Swissair's MD-11 fleet. IFT, through its subcontractor HI, was responsible for the design and installation of Swissair's MD-11 IFEN system. SR Technics was responsible for providing logistical support, technical data, and assistance on an "as requested" basis, and for performing the QA on each of the MD-11 IFEN installations in accordance with its JAR 145 obligations. SR Technics was not responsible for reviewing or approving the design and certification of the IFEN system.

See the supporting technical information on this topic.

1.18.7.3 SBA's letter of intent–FAA review

The FAA received the LOI for the Swissair project from SBA on 23 August 1996, and in accordance with established procedures, assigned an FAA team to review the LOI to determine the appropriate level of FAA involvement. In addition to certification engineers, the team consisted of personnel from the Manufacturing Inspection District Office and the Aircraft Evaluation Group (AEG). The AEG's responsibilities include determining the operational suitability of newly certified or modified aircraft, and unlike the other FAA certification responsibilities, which are delegated, the AEG's responsibilities are not part of the DAS's delegated authority.^{Footnote 101}

The LOI described the IFEN as a "non-essential, non-required passenger entertainment" system. SBA conducted a qualitative system safety analysis in accordance with FAR 25.1309, which concluded that no single failure or latent multiple failure of the system would affect the ability of the aircraft to continue safe flight and landing, significantly increase flight crew workload, or require unusual strength. The LOI also stated that there would be no changes to the pilot or co-pilot panels.^{Footnote 10}

Following their initial review of the LOI, the FAA contacted SBA to advise them of two additional test requirements necessary to certify the IFEN system. The first test involved assessing the crashworthiness of the associated new seat trays; the second involved assessing the flammability of IFEN-related materials being added within the cabin. On 3 October 1996, SBA submitted an amended LOI to the FAA incorporating the additional test requirements. The initial LOI was stamped "FAA Accepted" on 8 October 1996.

Based on the proposed IFEN system as described in the LOI, the FAA determined that SBA was capable of conducting the STC approval process. The FAA expected that SBA would inform them of any subsequent changes to the scope of the project, and that SBA would request FAA expertise as required. Other than those mentioned above, SBA did not submit any written changes to the LOI as the project evolved.

See the supporting technical information on this topic.

1.18.7.4 Evolution of the IFEN project under SBA

In completing its certification responsibilities, SBA was responsible for approving data supplied by HI, and for confirming that all aspects of the IFEN design and installation complied with the regulations. SBA was also responsible for witnessing tests, reviewing drawings, and checking for parts and installation conformity. SBA was not responsible for actual design or installation functions in support of the project. In addition, as a DAS, SBA had no certification responsibilities with respect to determining operational suitability.

The primary documents that were available for review by SBA were the drawings and supporting documentation identified in the master data lists and the ELAs produced by HI.

An earlier version of the ELA produced by HI, dated 18 August 1996, stated that electrical power for the IFEN would be supplied from the AC cabin bus distribution system, which could be manually shed during abnormal operations and automatically shed during emergency operations. There is no indication that SBA had access to the early version. Later versions of the ELA produced by HI indicate the power source, for the first- and business-class passenger sections, to be the 115 V AC Bus 2. The change in power supply followed the discovery by HI, in accordance with their analysis of the Swissair MD-11 electrical loads, that the cabin bus distribution system could not supply adequate electrical power to accommodate the full 257-seat IFEN configuration. The use of the 115 V AC Gen Bus 2 altered the intended function of the CABIN BUS switch, and the IFEN integration design did not identify the operational impact of this change. The change to the different power source was not reflected in the LOI submitted to the FAA, nor was a revised LOI submitted to the FAA.

The drawings used by SBA to approve the STC indicated that IFEN CBs were to be added to the lower avionics CB panel in the cockpit. The addition of the CBs into the cockpit was not reflected in the LOI submitted to the FAA.

The ELA work done at HI was completed by staff who had no experience with MD-11 aircraft. Neither SBA nor HI had staff members familiar with the MD-11 electrical design philosophy, which limited their ability to assess the compatibility of the IFEN integration with existing aircraft systems and with AOM checklist procedures. Wording in commercial contracts associated with the IFEN installation project suggested that other parties, including the operator, would be expected to participate in assessing the compatibility of the system-to-aircraft integration. The final ELA for the IFEN integration contained minor inaccuracies and was not provided to SR Technics until after the SR 111 accident.

1.18.7.5 IFEN integration–Electrical power supply

In the configuration that was certified, the IFEN was connected to aircraft power in a way that was incompatible with the MD-11 emergency electrical load-shedding design philosophy and was not compliant with the type certificate of the aircraft. The IFEN was powered from the 115 V AC Bus 2, an electrical bus that is not affected by the selection of the CABIN BUS switch.

The CABIN BUS switch was designed to permit removal of all electrical power from the aircraft cabin services, except for emergency services. The first item in the Swissair Smoke/Fumes of Unknown Origin Checklist is to select the CABIN BUS switch to the OFF position. The design of the IFEN system-to-aircraft power integration constituted a latent unsafe condition. However, as the fire was underway at the time the CABIN BUS switch was used (13 minutes, 7 seconds, after the initial smell was noted), no link was established between this latent unsafe condition and the initiation or propagation of the fire.

1.18.7.6 FAA oversight (Surveillance) of SBA

The FAA Los Angeles Aircraft Certification Office (LAACO) was responsible for regulatory oversight of SBA, which it accomplished by monitoring individual SBA DAS projects, and by conducting evaluations.

Although the FAA kept an administrative file on SBA, it was not normal business practice for the LAACO to keep records of their day-to-day contacts with SBA, or of their individual STC project monitoring activities. FAA files contained records of two formal evaluations of SBA, one in March 1996, and another in May 1998. Both of these evaluations contained findings of non-compliance with existing requirements; none of these findings were assessed by the FAA as being a threat to flight safety. The findings were described by the FAA as being "paperwork" related. The FAA was satisfied with the response of SBA to each of the evaluations. SBA was in compliance with all FAA requirements for a DAS at the time of the SR 111 occurrence.

Subsequent to the SR 111 occurrence, the FAA conducted a special certification review (SCR) of STC ST00236LA-D. Findings in the SCR point to shortcomings in both SBA's certification procedures and FAA monitoring of the project. On 30 November 1998, SBA relocated its operations to new facilities; regulations required that, because of the move, they must reapply for authority to continue as a DAS. At that time, SBA voluntarily surrendered its DAS certificate to the FAA. Subsequently, SBA became insolvent.

See the supporting technical information on this topic.

1.18.7.7 FAA aircraft evaluation group functions

Certain STC certification services are reserved for FAA approval and are therefore not delegated to a DAS. Such is the case for those certification services provided by the AEG.

Specifically, FAA Order 8110.4A indicates that the AEG should be involved in STC projects that affect operational suitability and ICA. Examples would include changes in crew requirements, flight instrument displays, and minimum equipment lists.

In the case of STC ST00236LA-D, SBA submitted an LOI that concluded that the IFEN was operationally suitable for use in the MD-11 aircraft. The AEG accepted this determination even though, as a DAS, SBA had not been delegated the authority to make such a determination.

See the supporting technical information on this topic.

1.18.7.8 Information provided to Swissair and SR technics

IFT provided technical training that focused on their approved servicing and maintenance activities to SR Technics maintenance personnel. Informal training was also available to Swissair aircraft crews to familiarize them with the operation of the IFEN system. As a result of frequent software-related problems, flight crews were informed through an AOM bulletin that, if necessary, they could use the 28 V DC IFEN CB on the lower avionics CB panel to shut down or reset the system. In the absence of a system ON/OFF switch, this procedure was meant to provide the flight crews with a means of dealing with routine IFEN anomalies. It is reasonable to expect that Swissair flight crews would have believed that if power needed to be disconnected from cabin services, the IFEN system, along with other cabin services, would be de-powered by turning off the CABIN BUS switch.

1.18.7.9 System design and analysis requirements

Compliance with FAR 25.1309 required that a system safety analysis be conducted on the IFEN system. Such analysis ranges from a qualitative assessment (e.g., a Functional Hazard Assessment), based on experienced engineering judgment, to a complex quantitative assessment (e.g., a Failure Modes Effects Analysis), which includes a numerical probability analysis. The FAA's AC 25.1309-1A introduced in 1988 does not differentiate between an "essential" or "non-essential" system but rather requires that failure analysis be performed on all aircraft systems. The IFEN system's functional criticality, assigned by SBA, was described as "non-essential, non-required."^{Footnote 103}

While the FARs do not use or define the term "non-essential, non-required," it is commonly used in the aviation industry to describe a system whose failure will not affect the safe flight and landing of an aircraft. Entertainment systems are typically described as "non-essential, non-required," with assumptions made that any failures would have only a "minor" effect on aircraft operation. This categorization allows the system safety analysis to be accomplished by a qualitative assessment based on prior engineering judgment of similar systems, and on a history of satisfactory in-service experience.

1.18.7.10 Operating anomalies

In the two Swissair MD-11 aircraft that initially had the IFEN installed in all 257 seats, in warm atmospheric conditions, the operation of the IFEN system added sufficient heat to the cabin that it became difficult to keep the cabin cool. Flight crews were informed that if the cabin became too warm, they were to select the ECON switch to the OFF position; this action would provide colder air in the cabin. Then, if the cabin did not cool sufficiently after four hours of flight, the remedy was to shut down the IFEN by pulling the 28 V DC IFEN CB on the lower avionics CB panel. The occurrence aircraft logbook had no record of any cabin temperature issues related to the IFEN installation. This temperature control problem was resolved when the IFEN was reduced to the 61-seat configuration and was not relevant to the occurrence aircraft.

1.18.7.11 IFEN maintenance history

IFEN maintenance records for the Swissair fleet were reviewed to find possible failures in wires or electrical components. Two instances of PSU failures were noted; one involved an MD-11, although not the occurrence aircraft, and one involved a B-747 IFEN installation.

The incident involving the MD-11 occurred on 30 August 1998. During flight, the F-9 CB for PSU 2 tripped. A reset was performed but the CB tripped again. Following the flight, when maintenance personnel reset the CB, it immediately tripped and a noise was heard from within PSU 2. The defective PSU was replaced, and the aircraft was returned to service. The PSU was subsequently checked, and it was noted that various internal components showed signs of short circuiting. The incident involving the B-747 was also an in-flight failure of a power supply, that cut power to the IFEN. The power supply was changed, and the aircraft was returned to service.

An assessment was completed to determine whether an IFEN PSU could have been the ignition source for the fire in SR 111. The recovered portions of the IFEN PSUs from SR 111 were examined, and no signs of fire damage were noted. In addition, there was no fire damage in the areas surrounding the PSUs. These observations are consistent with the hypothesis that the PSUs were located too far aft in the aircraft to fit the observed fire damage pattern. Overheating or failure of any of the IFEN PSUs was ruled out as a potential ignition source.

1.18.7.12 Post-occurrence IFEN documentation and installation

During the review of the IFEN system installation documentation, various discrepancies were noted in the approved drawings and supporting documentation prepared by HI. Examples of discrepancies include conflicting information between drawings, incorrect wire and pin identification, and incorrect references to other documents.

The information contained in the STC-approved type design data package did not contain sufficient detail to completely define the IFEN system installation configuration. Specifically, there were no installation drawings or supporting documentation that described how the PSU cables and 16 AWG control wire were to be routed through the area from the aft end of the lower avionics CB panel rearward to approximately STA 515. Instead of providing detailed drawings and installation information, in repeated instances, the data package documents referenced AC 43.13-1A, which provides general guidance for "best practices." This approach relies heavily on the training and experience of the individuals completing the installation work to determine wire routing and ensure quality of the installation.

At the time that the IFEN installations were taking place, there appeared to have been a broad range of interpretations as to what constituted an appropriate design package and what documentation was necessary to make acceptable findings of compliance for modifications such as the IFEN system. The FAA requirements stipulated that a drawing package be produced that completely defines the configuration, material, and production processes necessary to produce each part in accordance with the certification basis of the product. The requirements also stipulated that descriptive data packages should completely and accurately describe the fabrication, assembly, and installation of all portions of the modification.^{Footnote 104} The data package produced by HI was acceptable to the FAA's delegate (the DAS: SBA).

During the year that the occurrence aircraft operated with the IFEN installed, no discrepancies were noted in the aircraft records that could be attributed to the installation of the four PSU cables and 16 AWG control wire into the area from the aft end of the lower avionics CB panel rearward to approximately STA 515. However, an examination of the other MD-11s in the Swissair fleet revealed several discrepancies. Some instances were noted where IFEN wires were not installed in accordance with the installation drawings. Discrepancies included terminal lug connections on the PSU CBs that used attaching hardware that was not in accordance with the drawing information, and wires that were attached to the PSU CBs in a manner that would not be considered best practice. For example, it was noted that the installation drawings and EO did not specify a bonding strap at the lower avionics CB panel, as would be required when the panel is exposed to 115 V AC power; such as, when the IFEN 115 V CBs were added. Some of the discrepancies may reflect the lack of guidance in the data package. Wire routing varied from aircraft to aircraft.

The lack of complete and accurate installation information left decisions such as whether to install anti-chafing materials up to the installer. For instance, during TSB inspections of the installations on the other Swissair MD-11s, the PSU cables were found to be routed such that they came into contact with the edge of the fuel quantity data control unit located directly behind the lower avionics CB panel. This contact left indentations in the cable insulation. On some of the installations, spiral wrap was used to protect the cables as they passed the edge of the fuel quantity data control unit; spiral wrap was not observed in some other installations. As the approved data package did not describe the wiring installation within this area, no document change notices were created to record and account for variations in the wire routing. The IFEN PSU cables were at times routed behind aircraft wire runs prior to entering the conduit. For this reason, there was no way to accurately determine how the four IFEN PSU cables and 16 AWG control wire were routed through this area on the occurrence aircraft.

Following the SR 111 occurrence, the TSB monitored the FAA's full-scale fault insertion testing conducted on the IFEN system using specially designed test equipment. The testing involved introducing faults that would attempt to replicate conditions, such as multiple short-circuits, electrical over-current conditions, and cooling fan failures. In every case, the IFEN components performed as designed and did not produce excessive heat or show signs of wire or component damage. This work was carried out in a systematic way in a laboratory environment.

1.18.7.13 IFEN STC project management

The IFEN STC project involved nine companies and agencies: Swissair, IFT, HI, SBA, the FAA, the FOCA, Recaro, Rumbold, and SR Technics.^{Footnote 105} For the most part, the management of the project was effective despite numerous errors and omissions in documentation. However, a notable exception where overall project management was less than effective was in accomplishing the proper integration of the IFEN with the aircraft electrical system, specifically as it related to emergency procedures.

Swissair contracted with IFT to provide an IFEN that would be compatible with the MD-11 and would be certified to existing standards. IFT did not have the necessary expertise to integrate and certify the system, which necessitated subcontracting to HI. HI could accomplish the design and integration of the system into the aircraft but was not authorized to provide the required FAA certification; consequently, they subcontracted this task to SBA. While the companies involved were assessed by the FAA as having the proper corporate credentials to accomplish the design, installation, and certification, there was a lack of specific knowledge within these three companies about the MD-11 electrical system and about how it was designed to function during emergency procedures.

Some two-party contracts contained contractual obligations with a direct impact on a third party. In some cases, the third party appeared to be unaware of these obligations. Moreover, assumptions were made by IFT and its subcontractors that type-specific information, both operational and technical, would be provided by Swissair. Likewise, assumptions were made by Swissair that IFT, through its subcontractors HI and SBA, possessed the technical and operational capabilities to provide a fully certified IFEN system.

In addition, there was a lack of clarity regarding which entity had overall project management responsibility. The FAA regarded the applicant, in this case SBA, to be responsible for the overall project management of the certification process. However, it was IFT, through its subcontractors, that was obligated to deliver a certified and integrated IFEN system to Swissair. The certification responsibilities were subcontracted through HI to SBA. As such, SBA was responsible for certifying the IFEN system; however, they had no substantive role in the overall project management.

The IFEN STC was a complex project with an ambitious schedule. It required a clearly identified project management structure designed and executed to track a myriad of details. To be effective, such a structure should have ensured that all the elements were in place to design, install, and certify the system to be compatible with the aircraft's type certificate.

1.18.8 Chronological sequence of events

1.18.8.1 General

As part of the investigation, relevant information from the FDR, CVR, ATC tapes, FADEC NVM, recorded radar data, and ACARS was compiled in a timeline. (See Appendix D–Timeline.) Some of the information included in this section is also depicted on a map of the flight path (see Appendix A–Flight Profile: Selected Events.)

1.18.8.2 ACARS

1.18.8.2.1 Initial anomalies

Monitoring systems at ARINC and INMARSAT indicate that these two systems were functioning normally during the flight of SR 111. The INMARSAT logs indicate that the satellite telephone service on SR 111 was not used during the flight. The occurrence flight remained within the normal range for VHF coverage. When VHF coverage is available, it is the primary path for data exchange.

Audit logs from the service providers SITA, ARINC, and INMARSAT show that both the ACARS and SATCOM systems of SR 111 initialized and functioned as expected while the aircraft was at the gate at JFK airport in New York. The systems logged onto their networks at 2318:55 and 2330:18 respectively. The SATCOM logged on as a Class 3 mode for voice and data transmission, which indicates that the ACARS management unit (MU) and the satellite data unit were operational at this time.

The ACARS is designed such that if it is not used for 10 minutes, the ACARS MU will send a tracker message to let the service provider know that the aircraft ACARS receiver is still within the coverage area. An ARINC message was sent by SR 111 at 0021:18. Tracker messages would have been expected from the aircraft at about 0031:18 and 0041:18. There is no record that either of these tracker messages were received by a ground station, although the internal ACARS MU system and message counters were updated, as shown by subsequent messages recorded by the service providers. This indicates that messages were logged by the ACARS as being sent during that time frame. It is possible that the system could have logged onto one of two other networks that had some overlap coverage in the area. This can happen if one system becomes saturated. Records for verification of this information were unavailable by the time this aspect of the investigation was conducted and the data were requested by the investigation team.^{Footnote 106}

1.18.8.2.2 Thirteen-minute gap in VHF communications

About 15 minutes after take-off, a 13-minute gap in radio communications occurred between SR 111 and Boston ARTCC. The last communication from SR 111 prior to the gap occurred at 0033:12 when the captain acknowledged a radio frequency assignment change from Boston ARTCC (124.52 MHz to 128.75 MHz). Nine seconds later (0033:21), the FDR recorded a VHF 1 microphone keying event that would be consistent with the pilots attempting to contact Boston ARTCC. No transmission from SR 111 was heard on frequency 128.75 MHz or on any other recorded ATS frequency.

The SR 111 FDR recorded 11 microphone keying events by SR 111 during the 13-minute gap: 9 on VHF 1 and 2 on VHF 2. During this time, Boston ARTCC attempted to contact SR 111 four times on the assigned frequency of 128.75 MHz, three times on the previous frequency of 124.52 MHz, and at least once on the aviation emergency frequency of 121.5 MHz. None of the 11 keying events from the aircraft coincided with the times of the transmissions from Boston ARTCC, indicating that the SR 111 crew was not likely receiving the ATS radio calls.

At 0046:27, SR 111 called Boston ARTCC using VHF 1 on 134.95 MHz, a frequency that had not been assigned to the flight. This transmission was recorded on the ATS tape; however, the Boston ARTCC controller did not comprehend the call that was made on an unassigned frequency and did not immediately respond to this first SR 111 call.

The FDR indicates that at 0047:02, SR 111 attempted another brief call on VHF 1 on an unknown frequency. At 0047:03, INMARSAT logs show a downlink from SR 111 indicating that VHF 3 data communications were lost. This downlink would be consistent with VHF 3 being switched by the pilots from data to voice mode. At 0047:15, SR 111 again called Boston ARTCC using VHF 1 on 134.95 MHz. Communications with SR 111 was restored when Boston ARTCC heard and acknowledged this transmission, and instructed SR 111 to switch to the appropriate frequency for the area control sector they were in (133.45 MHz).

Two-way communications were then restored, and the controller established that the SR 111 crew could hear ATS clearly. There is no record of either the pilots or the controllers at Boston ARTCC making any further comments about the gap in communications. There were no reports of communications difficulties between ATS and any other aircraft in the area. No technical anomalies were recorded on the FDR during the 13-minute gap, and no plausible technical failures were determined during the investigation. It should be noted that FDRs record only a small percentage of the total electrical and systems activity that occurs on an aircraft. Radio communication gaps periodically occur when pilots inadvertently select an incorrect radio frequency when reassigned a new frequency. It is unknown whether this occurred in this instance; however, no other explanation was found.

1.18.8.2.3 Additional ACARS information

About 32 minutes of recorded information was retrieved from the CVR, starting at 0053:17 while SR 111 was cruising at FL330. INMARSAT records indicate that at 0053:51, there was a downlink from SR 111 confirming that VHF 3 communications had been lost for more than seven minutes. The time of this message correlates with the downlink message at 0047:03, indicating the loss of VHF 3 communications, and is consistent with the pilots having switched VHF 3 from data mode to voice mode.

At 0104:14, the ACARS MU sent a downlink message changing coverage from INMARSAT back to ARINC. This would be consistent with the pilots switching VHF 3 from voice mode back to data mode.

After 0104:14, the ACARS functioned as expected. The pilots successfully requested weather information via ACARS at 0113:13 and at 0114:37. The latter request was completed at 0115:18. There was no further crew-initiated communication using ACARS. The last message from ACARS was recorded at 0125:08, when a tracker message for flight following was sent and acknowledged by the system. At 0126:01, the ACARS MU failed as a result of the fire event.

1.18.8.3 Odour detected in the cockpit

The first indication of an abnormal situation was at 0110:38, when the first officer referenced an unusual odour in the cockpit. There were no alerts, warnings, or indications recorded on the FDR to identify any technical problem with the aircraft. No mention was made by the pilots at this time, or during the previous 17 minutes, about any technical problem.

At 0110:57, the captain said "look,"^{Footnote 107} indicating something was visible in the cockpit; it is probable that it was a small amount of smoke that he observed, based on the comment he made later at 0112:24: "It's definitely smoke which came out."

Having been given permission to stand up at 0111:06, the first officer transferred flying control of the aircraft to the captain at 0111:14, indicating that he was getting up. Fifteen seconds later, at 0111:29, the first officer indicated that there was nothing more "up there." This indicates that the visible smoke ceased within 30 seconds of first being noticed.

At 0112:06, the captain summoned to the cockpit a flight attendant working in the first-class cabin. A few seconds later, she opened the cockpit door and entered the cockpit. In response to a query from the captain, the flight attendant indicated that she could smell the odour in the cockpit, but had not noticed any odour in the cabin where she was working. No references were made to visible smoke at this time.

At 0112:24, based on the comment by the captain, it appears that wherever the smoke may have been originally spotted, the amount was likely small, momentary in nature, and no longer visible. Twice within a period of 18 seconds, the CVR recorded sounds of an electrically driven cockpit seat moving, each time for a period of two seconds. It is unknown whether it was the first officer's or the captain's seat that was moving. The captain commented "Air conditioning, is it?" The first officer answered "Yes." The manner in which the captain framed his inquiry suggests that he was confirming with the first officer the course of action they would undertake, such as selecting the System Display Air Page or the Air Conditioning Smoke Checklist. The first officer's confirmation indicates agreement, suggesting that both pilots agreed that they were dealing with an air conditioning anomaly. The captain indicated that something should be closed; most likely he was requesting that the flight attendant close the cockpit door, as within two seconds, sounds consistent with the cockpit door closing were recorded.

At 0112:52, the FDR recorded that the Air Page was selected on the system display. This selection could have been made anytime within the previous 63 seconds and would not have been immediately recorded by the FDR because of the 64-second sample rate interval for recording this FDR parameter. Selection of the Air Page is an action that the pilots would be expected to take to troubleshoot a suspected air conditioning smoke/fumes anomaly.

At 0112:54, the seat belt lights were activated in reaction to light turbulence being experienced.

At 0113:14, a discernable amount of smoke again became visible to the pilots. They considered potential diversion airports and the need to bring the navigation charts forward from the ship's library. Weather conditions were considered in the assessment of various destinations. The ACARS recorded request was for the following airports: LLSG (Geneva, Switzerland), KJFK (New York, New York), KBOS (Boston, Massachusetts), and CVQM (unknown; it is probable that the pilots meant to input CYQM, which is Moncton, New Brunswick, an airport 90 nm northwest of Halifax).

At 0113:53, the captain commented "That's not doing well at all up there." At 0114:05, the captain attempted to call Moncton ACC, but the radio transmission was blocked by a simultaneous transmission from another aircraft. The frequency had been, and continued to be, busy with calls from other aircraft. These other transmissions would have been heard by the SR 111 pilots.

At 0114:15, the captain radioed Moncton Centre and declared "Pan, Pan, Pan," requesting an immediate return to a convenient place. The captain's tentative airport selection for the diversion was Boston, an airport with which he was familiar. The flight was cleared to proceed to Boston and to maintain FL310. A right turn was initiated toward Boston. At the time of the "Pan Pan Pan" call, the aircraft was at FL330, 66 nm from the threshold of Runway 06 at the Halifax International Airport.

At 0114:48, the captain's oxygen mask was removed from its stowage box, and the sound of oxygen flowing from the mask was evident. The M/C indicated to a flight attendant that he had been advised that there had been some smoke observed in the cockpit, and that the captain did not want the cockpit door to be opened.

1.18.8.4 Diverting to Halifax

At 0115:06, the controller asked the pilots whether they would rather go to Halifax. Having identified Halifax as the closest airport, it was chosen. Halifax was a Swissair-designated intermediate alternate airport, and therefore was approved for MD-11 operations. At 0115:29, the first officer was reassigned the flying duties and instructed to descend immediately. Seven seconds later, the aircraft began descending initially at about 2 000 fpm. The airspeed was at or close to the selected airspeed value of 292 knots, which provided a ground speed of just over 8 nm per minute. The captain continued with radio communication duties. At 0115:36, the captain advised the controller that they would prefer Halifax. At 0115:41, SR 111 was cleared by the controller to proceed directly to Halifax and to descend to FL290. At this time, the aircraft was at FL328, about 56 nm from the threshold of Runway 06.

At 0115:56 and 0116:03, respectively, the captain and first officer donned their oxygen masks. Donning of smoke masks was not included on the Swissair smoke checklists, as it was considered to be a memory item and was a procedure that was practised in the flight simulator by all Swissair flight crews. In their simulator training, flight crews were instructed to don oxygen masks whenever smoke is present. It is not known how much smoke was being seen, if any, but it is likely that at least a smell would have been evident.

Between 0116:08 and 0116:27, the Halifax weather information was passed to SR 111 by the crew of an overflying aircraft. The controller cleared SR 111 to continue descent to 10 000 feet. Moncton ACC was coordinating the arrival of SR 111 with the Halifax tower via a land line. The Moncton controller asked SR 111 for the amount of fuel and the number of passengers on board so that he could pass the information to the Halifax Aircraft Firefighting Services through Halifax tower personnel. SR 111 told the controller to "stand by" for that information.

At 0117:19, the aircraft passed through FL297 and the speed brakes were fully extended. The rate of descent increased to 4 000 fpm, and then reduced to about 3 500 fpm by 0119:28. At 0117:20, the instrument approach plates for the Halifax Airport were not readily available to the pilots to provide information about the runway, minimum safe altitudes, and published approach details. A cabin call chime sounded a few seconds later. The captain then briefed the M/C that there was smoke in the cockpit, that the cabin crew was to prepare for landing in Halifax in about 20 minutes to half an hour, and that he was about to start a checklist. The tone of the captain's voice did not indicate that the situation was sufficiently critical to warrant an emergency; however, he indicated that the passengers were to be briefed that the flight was landing immediately.

With the autopilot engaged, the desired airspeed can be selected by either pilot using a rotary speed-set dial. Based on the FDR sample rate intervals, it is known that the selected airspeed was changed from 292 KIAS to 310 KIAS, during the interval between 0117:16 and 0118:20. Within this time period, at 0117:38, the captain indicated to the first officer that he should not descend too fast, likely referring to the airspeed that was being selected^{Footnote 108} rather than the aircraft's rate of descent. It is possible that some higher speed had been momentarily selected and then adjusted to 310 KIAS. At about 0119:24, the selected airspeed was further increased to 320 KIAS. The aircraft's maximum operating airspeed (barber pole speed) was 365 KIAS; the aircraft remained below that airspeed.

At 0118:17, SR 111 was directed to change to Moncton Centre frequency 119.2 MHz. The first officer, who continued as the pilot flying, was also assigned the radio duties. SR 111 was cleared to descend to 3 000 feet, but the first officer advised Moncton Centre of a preference to descend to an intermediate altitude of about 8 000 feet while the cabin was being prepared for landing.

At 0119:12, the controller asked the SR 111 pilots whether they would like radar vectors to Runway 06 at Halifax. The first officer asked for the latest wind information. The controller did not relay the wind information, but repeated that Runway 06 was the active runway and asked whether he should start the radar vectors. SR 111 accepted radar vectors for Runway 06 and the controller instructed SR 111 to turn left to a heading of 030.

The crew bag containing the approach charts for Halifax was stored in the ship's library beneath the right observer's station, an area that is not within reach of the pilots while they are in their seats. The captain had been attempting to contact a flight attendant directly for some time. At 0119:27, a flight attendant entered the cockpit and moved the crew bag containing the approach chart information to within the captain's reach.

At 0119:37, the controller informed SR 111 that the instrument approach to Runway 06 was a back-course approach. He provided the localizer frequency, and advised the pilots that they were 30 miles from the threshold of Runway 06. The aircraft was descending through FL210, and the first officer informed the controller that more than 30 miles would be required. SR 111 was instructed to turn to a heading of 360 degrees, to lose altitude.

At 0120:14, an announcement was made by the M/C to the passengers, informing them that the aircraft would be landing in Halifax in 20 to 25 minutes. The pilots agreed that a quick descent was warranted in case the smoke thickened. The first officer asked the captain whether he agreed with conducting a backbeam approach to Runway 06, indicating that it would be the quickest approach and would result in landing into wind. The first officer also mentioned fuel dumping and asked the captain about his preference for where and when to dump fuel. The captain seemed to concur; however, his verbal response to these inquiries was interrupted by a physical activity involving stretching, consistent with retrieving something that was out of normal reach, perhaps a checklist or an approach chart.

At 0121:20, the controller requested the number of persons and the amount of fuel on board. The first officer responded that there was 230 tonnes of fuel on board; this was actually the current gross weight of the aircraft, not the weight of the fuel alone. He did not relay the number of persons on board. He queried the controller about whether fuel dumping could be done in that area during descent. The controller responded by asking whether SR 111 was able to turn back to the south, or whether they wanted to stay closer to the airport. When conferring about this with the captain, the first officer stated that the controller would prefer that fuel dumping be done to the south, and asked the captain whether they should do that or whether they should go and land. Given their understanding of the current situation, the pilots decided that turning to the south for fuel dumping would be appropriate. The first officer informed the controller that a left or right turn toward the south was acceptable. The controller instructed SR 111 to turn left to a heading of 200 degrees, requested that the pilots indicate when they were ready to dump the fuel, and advised them that it would be about 10 miles before they were off the coast. He advised SR 111 that they were still within about 25 miles from the airport. The first officer informed the controller that they would stay at 10 000 feet, and the controller cleared SR 111 to maintain that altitude. At 0122:21, the speed brakes were retracted as the aircraft descended through 12 550 feet. The rate of descent reduced to 1 000 fpm, then subsequently increased to 2 000 fpm until the aircraft levelled off between 10 150 and 10 300 feet.

At 0122:33, the first officer asked the captain whether he was in the emergency checklist for air conditioning smoke. The captain indicated that he was. At 0122:37, the FDR recorded that the selected indicated airspeed (IAS) had been changed from 320 to 249 KIAS. This is consistent with applicable regulatory requirements, which stipulate that airspeed be reduced to a maximum of 250 KIAS when aircraft are at 10 000 feet or below. At 0122:41, the airspeed began to decrease from 320 KIAS.

At 0122:48, the captain provided some FMS advice as the first officer was "inserting" Halifax airport into the FMS to be able to display airport information, such as runway length and instrument approach information. At 0123:00, as the airspeed was decreasing through 306 KIAS, the first officer asked the captain for his agreement to reduce the speed only slightly. The captain indicated that he was proceeding with the checklist, and that the first officer could fly the aircraft as he thought best.

At 0123:22, the airspeed stabilized at 300 KIAS, never reaching the previously selected 250 knots. (It is likely that the selected IAS was increased to 300 KIAS prior to 0123:22, as the selected airspeed FDR sample at 0123:41 was 300 knots.) At 0123:30, the controller instructed SR 111 to turn to a heading of 180 degrees and advised that they would be off the coast in about 15 miles. The first officer confirmed they were maintaining 10 000 feet. At about 0123:51, possibly in consideration of the information that the coast was still 15 miles ahead, the selected airspeed was further increased to 320 knots. This would be consistent with a desire to start the fuel dumping as soon as possible.

At 0123:45, the captain referred to the CABIN BUS switch and asked for confirmation, which the first officer provided. Selecting this switch to the OFF position is the first item on the Swissair Smoke/Fumes of Unknown Origin Checklist (see Appendix C–Swissair Smoke/Fumes of Unknown Origin Checklist). With the CABIN BUS switch in the OFF position, the recirculation fans are turned off, and the airflow above the forward ceiling area would have changed from a predominant flow aft toward the fans, to a predominant airflow forward toward the cockpit.

At 0123:53, the controller informed SR 111 that the aircraft would remain within 35 to 40 miles of the airport in case they had to land quickly. The first officer indicated that this was fine, and asked the controller to inform them when fuel dumping could start.

Up until this time, there were no failures recorded on the FDR, and there were no indications of any systems anomalies reported by the pilots. As well, no smoke had been reported in the cabin area.

See the supporting technical information on this topic.

1.18.8.5 Multiple systems failures

Starting at 0124:09, and for the next 92 seconds, the FDR recorded a number of technical failure events that were associated with the failure of aircraft systems, as discussed in the report sections that follow. Both flight recorders and the VHF radios (communications with ATS) stopped functioning at about 0125:41. Near the end of this 92-second period, a reference was made within the cockpit to something burning. It is assessed that the location to which this reference was made was the overhead ceiling area of the cockpit.

1.18.8.6 Autopilot disconnect

At 0124:09, the FDR recorded a disconnect of Autopilot 2. It would be normal for the captain to have his PFD displayed on DU 1, and the first officer to have his PFD set on DU 6. The changes to the PFD displays triggered by the autopilot disconnect would be as follows: the Autopilot 2 status indication text, (displayed as "AP 2 "), which normally appears in a cyan colour, would change to a red flashing "AP OFF," and the lateral and vertical windows would become flashing red boxes. There would also be an aural warning tone; this aural warning tone was heard, beginning at 0124:09 and continuing until the CVR ceased to record.

At 0124:18, the captain noted, and the first officer confirmed, that the autopilot had disconnected. At 0124:25, the first officer informed Moncton ACC that they had to fly manually, and asked for a protected block of altitudes between 11 000 and 9 000 feet. The controller assigned the altitude block between 5 000 and 12 000 feet.

Although the pilots did not verbalize any attempt to cancel the aural tone, this would be an expected reaction in accordance with their training. It is not known whether the pilots attempted to engage Autopilot 1; however, the aural tone did not stop, and Autopilot 1 did not engage. If the crew attempted to engage Autopilot 1 and it was unavailable, the circuit for Autopilot 1, and the circuit required to cancel the aural tone must have already been compromised by the fire. The electrical power circuit for AFS 2 is powered from the 28 V DC Bus 3 through CB E-07 located on the avionics CB panel. One of the wires coming from this CB goes to the control wheel autopilot disconnect switches. The loss of power through this wire (e.g., as a result of being compromised by fire damage) would disconnect the autopilot, and prevent the autopilot aural tone from being reset.

If Autopilot 1 could not be engaged, this indicates that its armed status was inhibited. A failure of Autopilot 1 would, after two minutes, produce annunciator indications that likely would have been noticed by the pilots. The pilots did not mention any annunciator indications associated with Autopilot 1 in that time frame. Therefore, if Autopilot 1 failed it would have done so within the two minutes before Autopilot 2 disconnected and the "AP 2 OFF" alert appeared in the PFD. The electrical power circuit for the AFS 1 is powered from the 28 V DC Bus 1 through CB C-07 located on the avionics CB panel.

1.18.8.7 Altitude alerts

The CVR recorded an altitude alert tone at 0124:38.4 and again at 0124:41.6. The aircraft altitude selector was set to 10 000 feet at this time.

As the aircraft approached 10 000 feet from above, it started to climb again. Information from the FDR indicates that the first officer had changed his altimeter setting to 29.80 in. Hg, whereas the captain had left his altimeter on the standard setting of 29.92 in. Hg, which is the setting required when aircraft are flying above 18 000 feet. The altitude alert system has a 150-foot alert threshold. The two different barometric settings would cause an altitude difference of about 100 feet between the two altimeters. Each FCC would then generate a separate altitude alert tone as their respective thresholds were exceeded, as recorded on the CVR.

1.18.8.8 Declaration of emergency

Starting at 0124:35, and lasting intermittently until 0125:27, a land line conversation took place between Moncton ACC and the Halifax FSS, during which Moncton ACC advised Halifax FSS of the anticipated fuel dumping. The provision of this information, which is in accordance with standard practice, was meant to ensure that other aircraft were informed of the fuel dumping location so that they could stay clear of the area.

At 0124:42, the captain called Moncton ACC and declared an emergency. The first officer, in an overlapping radio transmission, acknowledged that SR 111 was cleared between 12 000 and 5 000 feet, and advised that they were declaring an emergency at time zero-one-two-four (0124). This "emergency" declaration from SR 111 was coincident with the land-line information exchange taking place between the Moncton ACC low-level supervisor and the Halifax FSS.

At 0124:53, the captain called Moncton ACC and indicated that they were starting to dump fuel and had to land immediately. At 0124:57, the controller replied that he would contact them in just a couple of miles, to which the first officer replied "Roger," at 0125:01. At 0125:02, the first officer restated that they were declaring an emergency; the controller acknowledged at 0125:05.

1.18.8.9 Cabin crew use of flashlights

At 0124:46, the cabin crew indicated that they had lost electrical power in the passenger cabin and that they were using flashlights to continue to prepare the cabin for landing. This is consistent with the CABIN BUS switch in the cockpit having been selected to the OFF position using Swissair's procedures, which had been referenced by the pilots at about 0123:45.

1.18.8.10 Loss of lower yaw damper A

At 0124:54, the FDR recorded the failure of lower yaw damper A. The failure was likely the result of a loss of power to the circuit and may not have been obvious to the crew. A message "YAW DMP LWR A OFF" would have been displayed on the EIS status page; however, the information would only be available to the crew if that status page had been selected. It is unknown whether this page was selected.

The lower yaw damper control circuit A is electrically powered from the 28 V DC Bus 1 through CB C-11 located in the avionics CB panel. Lower yaw damper B, which is also powered by the 28 V DC Bus 1 through CB C-12 in the avionics CB panel, did not fail at the same time. This indicates that the 28 V DC Bus 1 was still powered at this time. It is likely that either CB C-11 tripped or that a wire in its circuitry shorted or opened, possibly as a result of heat damage.

1.18.8.11 Loss of flight control computer 1 parameters

At 0124:57, Channel A of FCC-1 lost primary power, and within 15 seconds (at 0125:12), all of the data being reported to the FDR by FCC-1 stopped. The loss of FCC-1 Channel A would drop off some non-flight critical information displayed on the captain's PFD on DU 1, but would not affect the first officer's PFD on DU 6. The first officer was the pilot flying. Under these conditions, the master caution light would illuminate, and faults and various messages would appear on the EAD (typically DU 3), a cue light would illuminate on the SDCP, and warning lights would illuminate on the AFS panel.

The FCC-1 Channel A is electrically powered from the 28 V DC Bus 1 through CB C-17 on the avionics CB panel.

1.18.8.12 Loss of left emergency AC bus

Based on the loss of ADC-1, DEU 1 and the captain's pitot heat, all of which are electrically powered from the left emergency AC bus, it was concluded that this bus was lost at 0125:06. The arced condition of the left emergency AC bus feed wire corroborates this explanation. This arcing event would have tripped the left emergency AC RCCB B1-136 causing the left emergency AC and DC buses to switch to their emergency power source, the battery and static inverter. Subsequently, several system anomalies and failure events occurred, which were recorded on the FDR. A brief explanation of the resulting system losses follows.

1.18.8.13 Loss of altitude, airspeed, and total air temperature

Between 0125:06 and 0125:07, the pressure altitude, computed airspeed, and total air temperature parameters, as recorded in the FDR, became static. After about seven seconds, a no-data-update sequence began, indicating that the data updates to the FDR from ADC-1 were lost.

The aircraft's transponder Mode C, which provides aircraft altitude information to ATC radar, stopped transmitting at 0125:06. This correlates with the loss of functionality of ADC-1. The ATC transponder Mode A (which provides aircraft identification) was still available, indicating that the transponder had not failed.

ADC-1 is electrically powered from the left emergency AC bus through CB F-04 located in the overhead CB panel.

1.18.8.14 Loss of display electronic unit 1

At 0125:06, the data from DEU 1 was lost; a switchover to DEU 3 occurred after 0125:14. Normally, data recorded on the FDR is received through DEU 1. If DEU 1 data is unavailable, the data will freeze for eight seconds, and the source will automatically switch to DEU 3.

Electrical power for DEU 1 is supplied by the left emergency AC bus through CB F-03 on the overhead CB panel. The loss of the left emergency AC bus would result in the captain's DU 1 and DU 3 going blank; the subsequent loss of DEU 1 would cause a red X to appear across DU 2.

1.18.8.15 Change of slat parameter "Retract to transit"

Between 0125:06 and 0125:14, the slats proximity sensor electronic unit B sensors changed from "target near" to "target far." This was a result of electrical power being lost to the B sensors.

The B sensors are powered from the 28 V DC Bus 1 through CB E-09 on the avionics CB panel. The loss of power to this CB would not have any effect on the cockpit displays.

1.18.8.16 Change of TCAS parameter "TR advisory to standby"

Swissair's practice is to use transponder ATC-1 on odd number flights and ATC-2 on even number flights. If ATC-1 loses altitude data from ADC-1, the traffic alert and collision-avoidance system (TCAS) goes into a Standby mode (as was recorded on the FDR) as long as the ATC-2 still has altitude information. The TCAS senses ATC-2 transponder input but does not use that information unless ATC-2 is selected on the ATC control panel. "TCAS STBY" would be displayed on the PFD and NDs, and an "ATC XPDR1 FAIL" message would be displayed on the EAD even though ATC-1 is still transmitting Mode A information. If no air data were available from ATC-2, the TCAS would go into the "OTHER" mode and "TCAS FAIL" would be displayed on the PFD and the NDs. The TCAS "OTHER" mode is a recorded parameter but did not appear on the SR 111 FDR.

This combined information signifies that ADC-2 was still functional at this time.

1.18.8.17 Change of captain's pitot heat "on to off"

Between 0125:06 and 0125:14, the power for the captain's pitot heat was lost. The heater is electrically powered by the left emergency AC bus through CB F-05 located on the overhead CB panel.

The loss of the captain's pitot heat would activate the master caution light, and various cues and alerts would appear on the SDCP, the EAD, and the SD.

1.18.8.18 Loss of VHF-1 reception

At 0125:05.6, an ATC transmission of less than one second was received through VHF 1 and recorded on the CVR. The next ATC transmission, starting at 0125:16, was not recorded by the CVR. The start of the next ATC transmission, starting at about 0125:40, was received and recorded for about 0.2 seconds.

For the CVR to not record an ATC transmission, the VHF signal would have to be lost. The VHF signal can be lost either through a loss of power to the VHF-1 transceiver, or through the transceiver going below a minimum threshold voltage. As the audio signal came back briefly before the end of the recording, it is concluded that the transceiver had gone below the minimum threshold voltage. The cut-out voltage, where the transceiver would stop operating, was found to be about 13 volts.

The VHF-1 transceiver is electrically powered by the left emergency DC bus through CB D-08 on the overhead CB panel.

1.18.8.19 CVR P1 channel intermittent

At 0125:06, the 28 V DC power supply to AMU-1 began to fluctuate around 12 V DC, but did not cut out. This assessment is supported by the fact that starting at this time, there was intermittent, attenuated, and distorted recording by the CVR captain's audio (P1) channel of inputs associated with AMU-1.

1.18.8.20 Loss of Audio Channels on CVR

From 0125:06 to 0125:34, the recording of the P1 channel was intermittent. The first officer's audio channel, the cabin interphone, and the CVR CAM all continued to record normally until 0125:41.4, when the CVR recording stopped.

At 0125:16, Moncton ACC transmitted a clearance to SR 111 to dump fuel on their present track, and to advise when the dump was complete. This transmission was not recorded on the SR 111 CVR. Therefore, it is unlikely that it was heard in the cockpit. A second clearance from Moncton ACC to dump fuel was transmitted at 0125:40. A 0.2 second fragment at the start of this second transmission was recorded 1.4 seconds before the CVR stopped recording.

1.18.8.21 Loss of first officer's display units

At 0125:16, the first officer advised the captain that he was just flying, and not doing anything else. At 0125:20, the captain referred to something that was burning already, and the first officer made a reference to landing. At 0125:33, the first officer indicated that his side was all dark, and also made reference to standby instruments and speed. It is likely that the first officer's three DUs (DU 4, DU 5, and DU 6) had gone blank. For all three displays to go blank, each unit has to lose its own power source. All three units are powered from the right emergency AC bus, which was still powered, through three CBs located on the overhead CB panel at positions F-29, F-30, and F-31. Therefore, either the individual CBs tripped or the integrity of the wiring was compromised.

1.18.8.22 Loss of upper yaw damper A

At 0125:34, the FDR recorded the failure of upper yaw damper A. The failure was likely the result of a loss of electrical power to the circuit. This failure may not be obvious to the crew; however, a message "YAW DMP UPR A OFF" would be displayed on the EIS status page, if that page had been selected. It is unknown whether this page was selected.

The upper yaw damper control circuit A is electrically powered from the 28 V DC Bus 3 through CB E-11 located in the avionics CB panel.

Upper yaw damper control circuit B, which is also powered by the 28 V DC Bus 3 through CB E-12 on the avionics CB panel, did not fail at the same time. This indicates that the 28 V DC Bus 3 was still powered, and that either CB E-11 tripped or a wire in its circuitry experienced an arcing event, possibly as a result of heat damage.

1.18.8.23 Flight data recorder stoppage

Between 0125:39.8 and 0125:40.2, the DFDAU started a warm reboot sequence resulting from a power interruption. The DFDAU re-synchronized and provided additional valid data for 1.3 seconds before the FDR stopped recording.

The DFDAU and the FDR are powered from the 115 V AC Bus 3 through CB D-31 on the avionics CB panel. The warm reboot was the result of either a temporary short or temporary open circuit.

1.18.8.24 Loss of cockpit voice recorder

At 0125:41.4, the CVR stopped recording. This is attributed to a loss of electrical power. The CVR is powered from the right emergency AC bus (phase C) through CB F-20 located on the overhead CB panel.

1.18.8.25 Possible VHF transmission from SR 111

At 0125:46, Moncton ACC recorded an unintelligible fragment of audio that could have been from SR 111.

1.18.8.26 Mode C returned

At 0125:50, transponder Mode C data was regained by ATC until 0126:04.1. Mode C data had been lost with the loss of ADC-1 at 0125:06. If the captain switched to DEU-Auxiliary, DU 2 would be reconfigured to a PFD with the air data parameters showing red Xs. To regain air data, he would have had to switch from ADC-1 to ADC-2. This would have restored air data resulting in ATC regaining Mode C.

1.18.8.27 Loss of transponder

The radar recorded the last transponder Mode A and C returns at 0126:04.1. This failure is attributed to a loss of power to ATC-1 transponder after this time. The ATC-1 transponder is powered from the 115 V AC (phase A) Bus 1 through CB B-21 located on the avionics CB panel.

1.18.8.28 Engine 2 shutdown

Damage to Engine 2 was consistent with an engine that was not producing power at the time of impact. The fault data that was recorded in the NVM of the FADEC indicated that the engine was shut down by use of the FUEL switch at about 1 800 feet;^{Note de bas de page 109} the airspeed was about 227 knots TAS. In general, during flight operations, the pilots could be expected to shut down an engine if they determined that a malfunction existed that would either cause severe engine damage or collateral aircraft damage, or be a hazard to continued aircraft handling. However, prior to the stoppage of the CVR and the FDR, there was no recorded indication of any mechanical malfunction of the engines, and no indication of any crew intention to shut down Engine 2.

Three FADEC fault entries revealed that Engine 2 had a loss of TRA. Loss of TRA inputs would cause the Engine 2 to revert to a fixed thrust mode and to maintain power at the last validated EPR value (thrust setting); it was determined that this thrust setting was flight idle. Flight crews would not normally be prompted to shut down an operating engine if the only discrepancy was that the thrust setting was fixed at flight idle, unless the planned operation of the aircraft, such as an imminent landing, required such an action.

The power wire for the fire detector loop A for Engine 2 shows clear indication of electrical arcing. This damage to the power wire would cause the loss of power to the fire detector loop A circuit. This would result in the FIRE DET 2 FAULT display, a Level 1 (amber) alert on the EAD, and would not result in a false fire alarm. The wire shorting or opening would not cause any overhead lights to illuminate. The crew never mentioned any alerts being displayed and the arcing event was considered to have occurred later in the sequence after the fire was already established.

If the ground wire for the light circuit to Engine 2 fire handle and fuel condition switch was grounded because of fire damage, then both lights would illuminate. The ground wire for this circuit was routed through an area of known fire damage where arcing events had occurred. This specific wire was not recovered; therefore, its condition could not be confirmed. It is possible that fire damage to this wire triggered illumination of the Engine 2 fire handle lights or FUEL switch light, which could prompt the pilots to shut down Engine 2. The Swissair Engine Fire checklist directs the flight crew to reduce the throttle to idle, then turn off the FUEL switch. This latter switch movement would have registered the faults that were recorded on the FADEC.

This was the last recorded information prior to the time of impact at 0131:18.

1.18.9 Witness information

1.18.9.1 General

Immediately after the occurrence, the RCMP Major Crimes Unit (MCU) dispatched four teams of investigators into the area surrounding the occurrence site. TSB investigators worked closely with the RCMP MCU to obtain information from witnesses who heard or saw the aircraft prior to the time of impact.

See the supporting technical information on this topic.

1.18.9.2 Witness interviewing methodology

TSB and RCMP investigators interviewed more than 200 potential ear and eye witnesses and took 88 separate statements related to the event. TSB investigators reviewed the preliminary statements taken by the RCMP and conducted their own interviews with witnesses who had said that they saw the aircraft during the latter portion of its flight. The majority of the ear and eye witnesses were in the areas of Blandford, East Ironbound Island, Tancook Islands, Indian Harbour, and Peggy's Cove. No witnesses saw the aircraft's impact with the water.

Additional interviews were conducted by law enforcement and safety investigators with personnel, based in New York, whose job functions were related to the security, pre-flight preparation, and dispatch of the occurrence aircraft. TSB and RCMP investigators also interviewed personnel at the involved companies in Zurich.

1.18.9.3 Summary of ear and eye witness information

Investigators collected information from 72 witnesses who said that they saw or heard the occurrence aircraft during the final minutes of its flight. All witnesses indicated that the aircraft was flying at normal flight attitudes, characterized by gentle banked turns and level or shallow pitch attitudes. Numerous witnesses recalled the loud sound of the aircraft engines.

Several witnesses reported seeing white, red, and green lights illuminated on the exterior of the aircraft. The white light was generally reported to be fixed (not flashing) and more brilliant than the coloured lights, which were flashing. One witness reported seeing blue flames on the left side of the aircraft, forward of the left wing.

Four witnesses reported smelling fuel, kerosene, or oil after the aircraft passed overhead. Three additional witnesses reported feeling moisture falling from the sky after the aircraft passed overhead. One witness at St. Margaret's Bay and a second witness at Blandford described a wedge or triangular-shaped haze trailing behind the aircraft. Line-of-sight estimates from eye witnesses suggest that the aircraft passed over the Blandford/Bayswater area at an altitude of between 2 000 and 5 000 feet agl.

There were no witnesses of the final descent of the aircraft into the water, nor were there any reports of a post-crash fire. Several witnesses recalled hearing a final sound that was similar to a clap of thunder. The sound was of short duration and high intensity, and was followed by silence. The time of the final sound was reported to be at approximately 1030 Atlantic daylight time (0130 UTC).

1.18.10 Reporting of cabin anomalies

1.18.10.1 Reports of unusual odours

On the first flight following a scheduled maintenance inspection, approximately three weeks prior to the SR 111 accident, when HB-IWF was operating as SR 178, an unidentified smell was detected within the aircraft cabin in the vicinity of the L1 door. This location is below an area where some of the heat damage was observed on the SR 111 aircraft wreckage. Various descriptions provided by the aircraft crew included smells similar to an over-heated electrical appliance or an unfamiliar type of gas or chemical. The smell incident was verbally reported to a maintenance engineer immediately following the flight; his inspection of the area did not reveal any discrepancy. Subsequent explanations included a possible residue of an insecticide that had been administered during the maintenance inspection prior to flight or fumes from the cargo compartment. The cargo manifest indicates that some solvents were being carried as dangerous goods in the forward cargo hold during that flight, although no cargo spills or loss claims were reported. The source of this smell on SR 178, which occurred 23 days prior to the accident flight, was not identified. There were no further reports of any recurrence of such a smell condition on the 50 subsequent flights of HB-IWF, and there is no reason to link the events of flight SR 178 to the accident flight.

On two separate occasions, a "burnt" or "burning" odour was detected on another Swissair MD-11 aircraft, HB-IWH. On 11 July 1998, a passenger on board HB-IWH operating as SR 111 detected a burnt odour. The smell was detected in flight after the meal service in the area of passenger seat 14H. On 18 August 1998, a passenger on board SR 264, aircraft HB-IWH, detected an unusual smell described as a burnt odour. The smell was detected prior to take-off in the area of seat 18J, mid-cabin. The M/C investigated, but did not smell anything. He reported this to the flight crew.

Because the same aircraft (HB-IWH) was used for both flights and because on each flight, passengers reported a burnt odour within an area spanning four passenger-seat rows (passenger seat 14H and 18J respectively), investigators assessed the possibility of potential links between the July 1998 and the August 1998 flights of HB-IWH. However, because there are no records or other information indicating the source of the burnt odour on the August 1998 flight and because the passenger from the July 1998 flight only reported the burning smell to the TSB several months after the flight, it was not possible to draw any link between the two events.

1.18.10.2 Procedures for reporting and recording abnormal conditions

A search of the Swissair MD-11 Cabin Flight Report database for additional information concerning abnormal smells on board HB-IWF and other MD-11 aircraft since 1997 resulted in only one other report. At the time of the occurrence, the procedures for cabin crew to record abnormal conditions did not clearly state when a written report (Cabin Flight Report) was required. Also, the procedures for flight crew regarding the recording of abnormal conditions reported to them by cabin crew allowed for discretion by the flight crew. Such abnormal conditions would have been recorded, at the captain's discretion, in the aircraft logbook. A logbook entry would have resulted in a subsequent maintenance action. Because no such entry was recorded in the logbook, an opportunity to troubleshoot the source of the unusual odours was lost.

See the supporting technical information on this topic.

1.19 Useful or effective investigation techniques

This section describes investigation techniques that are specific to the SR 111 occurrence investigation, as well as the features of these techniques and the reasons for their use.

1.19.1 Exhibit tracking process

1.19.1.1 Physical wreckage databases

Aircraft debris was recovered from the crash site and transported to the CF facilities at 12 Wing Shearwater, Nova Scotia. The progress of the recovery effort was monitored by tracking the weight of all recovered items as a percentage of the total structural weight of the aircraft. Recovered items were sorted and classified by their location on the aircraft and by their potential significance to the investigation. Items that were not considered significant were placed together with other similar items corresponding to the location of the item within the aircraft, and were stored in large boxes. Items categorized as significant for priority examination were photographed and assigned a unique exhibit number; a textual summary description was created for each exhibit. This information was entered into an Evidence and Reports III database used by the RCMP for case management; this factual exhibit information was available to the RCMP and the TSB and was ultimately imported into a separate safety investigation database developed by the TSB. Storage boxes containing items that were sorted and categorized as less significant to the investigation were also entered into the database as composite exhibits, to permit tracking and potential future retrieval as required. The exhibit and reporting database allowed investigators to view photographs and exhibit descriptions for each significant individual item, and to generate summary reports based on that exhibit information.

A separate database was established to track exhibit descriptions and information related to aircraft wiring.

1.19.1.2 Document control

Records supporting the investigation were assigned a document control number and registered in an electronic document control log database. A cover page, known as a "header banner," was produced for each document that was to be optically scanned to be converted to an electronic format. The header banner was used to identify the document content, and provides sufficient details to assist in document retrieval.

SUPERText® case management software,^{Footnote 110} which merges imaging technology, full-text search capability and structured database technology and allows full text query, was used as the document management system. Components of the software were used to scan and process the records using optical character recognition technology, and further organize the records. SUPERText® search utilities allowed users to retrieve documents using a variety of search criteria including keyword searches, and to view or print high-quality images of these documents.

1.19.1.3 Photograph database

A photograph database was developed to archive the large volume of digital and 35 mm images that were taken by RCMP and TSB investigators. The database was indexed to allow flexible searches by exhibit number, subject matter, date, location, and various other parameters.

1.19.2 Data analysis tools

1.19.2.1 Photographic panoramas and object models

Panoramas and object models of various items within the aircraft were created by taking a series of static photographs from various orientations. Object models were created by rotating an object in 10-degree increments in front of a fixed camera. Panoramas were created by fixing the object and rotating the camera. In both cases, "stitching" software^{Footnote 111} was used to combine the multiple individual photographs to create a two-dimensional rendering of the object. Additional software utilities allowed investigators to view these renderings with a standard web browser, to electronically rotate the images on a two-dimensional plane and to navigate between objects.

1.19.2.2 Computer-aided design analysis

Three-dimensional CAD drawings of the aircraft were received from the aircraft manufacturer.

CAD models^{Footnote 112} of the aircraft structure were developed and were cross-referenced to information about recovered components. Internet browser plug-ins^{Footnote 113} provided the capability to view these CAD drawings with a standard web browser. These tools were used to analyze the routing and spatial orientation of various components, to review temperature patterns, to study the airflow within the aircraft, and to develop fire propagation scenarios.

1.19.2.3 Integrated access to electronic data

A PRODOCs^{Footnote 114} software application was developed by the TSB to provide a single point of access to investigation data from the RCMP's Evidence and Reports III database, the SUPERText® Research database of hard-copy documents, the photograph database, and the wiring database. It also provides links to other related tools, resources, and applications, including the Cabin Safety Research Technical Group accident database, technical notes, photographic panoramas and object models, two-dimensional and three-dimensional CAD diagrams, and video clips of various investigation activities.

1.19.3 Partial qircraft reconstruction

A full-scale metal framework of the front 10 m (33 feet) of the aircraft fuselage was fabricated by the Nova Scotia Department of Transportation and Public Works Mechanical Branch. Identified portions of primary structure, skin panels, and air conditioning ducts were straightened, fracture matched, sewn together with wire, and installed on the reconstruction mock-up. (See Figure 19.) Galleys 1, 2, and 3 were partially reconstructed over separate wire mesh frames and positioned within the reconstructed framework. Pieces of the cockpit seats, cockpit ceiling liner, and CB panels were puzzled together and subsequently fixed into position within the reconstruction mock-up.

Information derived from the physical reconstruction was incorporated into a three-dimensional computer model of the aircraft forward fuselage section. The reconstruction framework and computer model were used to determine the severity and limits of the fire damage, to identify possible fire origin locations, to clarify the spatial relationships between components, and to illustrate how these relationships may have affected the progression of the fire. These tools were also used to help assess the flammability of materials and to identify other safety deficiencies.

1.19.3.1 Tabletop reconstruction of cockpit and forward cabin ceiling areas

The reconstructed air conditioning ducts, electrical wiring, and identified components within the forward cabin and cockpit ceiling areas were assembled into a large tabletop mock-up in an attempt to get a top view of the damage patterns and better understand the relative spatial orientation of the items. (See Figure 27.) A wooden frame and clear plexiglass materials were successfully used to rebuild areas that would otherwise become hidden from view once installed in the main reconstruction mock-up. The tabletop mock-up was used to help assess the heat damage pattern.

1.19.3.2 Air conditioning ducts

All of the recovered air conditioning ducts were severely damaged and deformed. Many of the ducts from the front attic area had been heat-damaged; therefore, it was important to reconstruct them to develop an understanding of where the fire started and how it spread. The hundreds of heat-damaged pieces were straightened, fracture matched and sewn together with wire. As only short segments of duct could be rebuilt, it was necessary to consult aircraft manufacturing drawings and expert technicians from the operator and manufacturer to position the rebuilt sections of ducts into the reconstruction mock-up.

1.19.4 Electrical wire arc sites analysis

Twenty segments of electrical wire from the occurrence aircraft exhibited areas of copper melt consistent with characteristics caused by electrical arcing events. Electrical wire arcing can occur when the insulation protecting a powered wire is damaged, exposing the conductor. The arc event creates sufficiently high temperatures to initiate a fire. Alternatively, a fire-in-progress can burn away the wire insulation, exposing the wire conductor. An arc will occur if the conductor makes contact with a conducting material, such as a metal structure or another exposed conductor of different electrical potential. Attempts were made to determine whether the SR 111 electrical wire arcing events were the result of a pre-existing fire or whether the arcing had provided the energy necessary to ignite nearby flammable material.

1.19.4.1 Auger electron spectroscopy

AES is a scientific technique that was used to attempt to differentiate between electrical wire arcs that could have caused a fire and arcs that resulted from being subjected to a fire-in-progress. The technique is based on the premise that combustion by-products are trapped in molten copper during an arcing event. A scanning Auger multiprobe, capable of high-resolution AES, is used to analyze the surface and near-surface chemistry of the copper arc melt sites and to detect the presence of combustion by-products in the resolidified copper. The absence of combustion by-products in the resolidified copper at an arc melt site is indicative of an arcing event that may have taken place in the absence of fire contaminants in the immediate area of the arc, and could indicate that the arc initiated a fire. This method also allows for a chemical examination of the resolidified copper melt surface without destroying the sample.

See the supporting technical information on this topic.

1.19.4.2 Focused ion beam and transmission electron microscope analysis

Auger spectra typically provide an indication of the presence and amount of specific elements on the surface of a copper arc melt. Knowledge of the vertical elemental profile, morphology, and porosity of selected arc sites was obtained by combining AES techniques with focused ion beam (FIB) etching and transmission electron microscopy (TEM) examination.

Arc sites of particular interest were identified during the AES surface analysis. Subsequently, thin vertical slices (lift-outs) were removed from these specific sites using a Gallium ion gun. A micro-manipulator was used to transfer the lift-outs from the FIB chamber to the TEM. High-resolution photomicrographs were then collected to determine the vertical homogeneity, porosity, grain size, and layering of each sample. Additional TEM analysis was then carried out to determine the elemental depth profile of selected lift-outs.

1.19.4.3 X-Ray microtomography

X-rays were taken of the recovered wire segments that exhibited copper arc melts characteristic of electrical arcing. A transmission X-ray micro-scanner, equipped with a precision object manipulator, was used to produce two-dimensional X-ray images of the wire's internal micro-structure at various orientations. Tomographical reconstruction software was used to render a three-dimensional image of the wire's internal micro-structure, by combining the successive plane-view X-ray images. The resulting micro-tomographs provided a permanent three-dimensional record of the morphology of the original wire samples. Characteristics, such as porosities, extent of melting and solidification, single or multiple arcing events, and inclusions can be assessed. This information can be used to guide decisions pertaining to more intrusive analysis techniques.

1.19.5 Temperature reference coupons

To permit an evaluation of the temperature reached by the hundreds of heat-damaged aircraft pieces, various heat templates or temperature reference coupons were produced in a controlled laboratory environment. The coupons consisted of representative samples of MD-11 aircraft materials, painted in accordance with the original manufacturer's specifications. Each temperature coupon was heated at a fixed temperature for a specified period of time. Temperature reference coupons were produced at 50°F increments for temperatures ranging from 300°F to 1 100°F (149°C to 593°C), and for exposure times of 10, 20, and 30 minutes. Each coupon was characterized by a discolouration of the painted finish that was indicative of the bake temperature and duration of exposure. The effect of immersion in sea water of the heated samples was also determined; at most temperatures the effect on the discolouration was negligible.

Hundreds of pieces of aircraft structure and air conditioning ducting exhibited indications of heat damage. The recovered pieces were compared to the temperature coupons constructed from identical material to determine the approximate temperature and duration of exposure. This information was used to establish heat pattern and temperature distribution within the fire-damaged attic area of the aircraft.

For comparison purposes, metallurgical analysis of temperature coupons and of the hottest recovered aircraft pieces was performed to more closely assess the temperatures reached based on the effect of the heat on the micro-structure of the various samples.

See the supporting technical information on this topic.

1.19.6 Speech micro-coding analysis

A strong relationship exists between language use and human performance. An analysis of the verbal communications between the pilots within the cockpit, and between the pilots and ATC was conducted to help assess crew coordination, workload, and problem solving in handling the situation. A speech micro-coding protocol was refined from academic literature and was used to classify verbal communication segments in order to derive and analyze relevant data. Cockpit crew communications were partitioned into verbal thought units (VTU), with each VTU representing a verbal communication dealing with a single thought, intent, or action. Nine speech forms and seven qualitative descriptors were used to classify each VTU, and to evaluate the adequacy and appropriateness of the communication. This coding was further used to analyze how task focus, as measured through verbal communication, was distributed between the two pilots.

1.19.7 Fuel detection by laser environmental airborne fluorosensor

A remote sensing aircraft, operated by the Environmental Technology Centre of Environment Canada, was used to search for aviation fuel that may have been intentionally dumped from the SR 111 aircraft as it manoeuvred for landing at the Halifax airport. The remote sensing aircraft was equipped with a Laser Environmental Airborne Fluorosensor (LEAF) system. This sensor collects fluorescence data from various surfaces in the marine and terrestrial environment by shining a laser onto the surface of the earth. Certain compounds, including polycyclic aromatic hydrocarbons found in petroleum oils, absorb and re-emit the laser energy as bands of fluorescence. Few other compounds in the environment show this tendency. In addition, different classes of oil, fluoresce with different intensities and exhibit different spectral signatures, meaning that each class of petroleum oil can be uniquely identified. This technique was successfully used to locate and identify Jet A fuel, the type of fuel on board the occurrence aircraft, in the vicinity of the SR 111 flight path. Although the fuel spectral signature was compared to a fuel sample taken from the JFK airport fuel tank used to refuel SR 111, the LEAF technique did not establish whether the Jet A fuel detected on the ground came specifically from SR 111.

See the supporting technical information on this topic.

1.19.8 Aircraft engine analysis

1.19.8.1 Industrial x-Ray for assessing internal component positions

During the investigation of the aircraft engines, the need arose to determine the position of the spool valve within the body of the thrust reverser system hydraulic control unit (HCU). The first option was to disassemble the unit. However, during disassembly there is a possibility of altering the positioning of the spool valve and, in light of the corrosion that had developed from submersion in the sea water, disassembly would not have been easily accomplished. Therefore, the unit was transported to an industrial radiograph (X-ray) facility at Canadian Forces Base Shearwater where it was X-rayed. Analysis of the radiograph film easily identified the control valve position within the HCU body. Where disassembly was required, a radiograph was taken prior to disassembly to document the internal positioning of the components for reference purposes. This technique was also used to view the locking mechanism of the thrust reverser system locking actuators.

1.19.8.2 Thrust Setting Determination from Engine Fuel Metering Units

The external examination of the FMU determined that the resting position of the sector gears differed among the three units, suggesting different fuel flows to each of the three engines at the time of impact. Physical examination of the damage to the engines was also consistent with different power settings. The FMUs were transported to the component manufacturer's facility for disassembly and examination under the control of TSB investigators. The objective was to relate the position of the FMU sector gears to the position of the fuel metering valve and fuel flow. During the examination, the position of the fuel metering valve spool relative to the metering valve sleeve was measured and compared against the manufacturer's drawings, to determine fuel flow from these measurements. This information, along with information gathered from other areas of the engines, was helpful in determining the approximate thrust levels of the engines at the time of impact.

1.19.8.3 Determination of engine thrust level via stator vane actuators

The variable stator vane (VSV) control subsystem provides maximum compressor performance by moving the HPC inlet guide vanes and 5th, 6th, and 7th stage HPC vanes to their programmed positions in response to commands from the FADEC. During an engine start, the VSVs may be in an open position until approximately 15 per cent N₂, at which time they would close. At speeds above approximately 40 per cent N₂, the VSVs modulate to open with increasing N₁ and N₂ and are fully open at take-off and climb power. The vanes modulate with N₁, N₂, and Tt2.

The three VSVs were transported to the manufacturer's facility for disassembly and examination under the control of TSB investigators. Measurements were taken from the centre of the piston face to the actuator aft housing surface. This measurement was used to determine the position of the piston relative to the piston full stroke. The results of this calculation were then interpreted to provide engine thrust level. This information, in concert with other factual information gathered from the FMUs and bleed valves, helped to establish the approximate thrust levels of the SR 111 engines at the time of impact.

1.19.8.4 Determination of engine thrust level via bleed valves

The three 2.5 bleed valves, one from each engine, were disassembled and examined at the manufacturer's facility under the direction of TSB investigators. Measurements were taken from the mounting surface of the housing to the end of the piston to determine the "as-received" position of the piston. This measurement value indicates the position of the piston relative to the fully-extended position, and thus reflects the percentage of its full stroke. This percentage reflects the engine thrust level in engine revolutions per minute at the corrected low pressure rotor speed. These values, used in concert with other factual information, helped to establish the approximate thrust levels at the time of impact.

From visual examination of the six 2.9 bleed valves, the determination was made regarding whether the valves were open, closed, or jammed in a position as a result of impact. This information, in concert with other factual information, helped to establish thrust levels at the time of impact.

1.19.8.5 FADEC fault analysis

The FADEC is a source of stored information that is particularly useful for investigating accidents in which the FDR has stopped prematurely, as it did near the end of the SR 111 flight. The information may be downloaded from the NVM at the FADEC manufacturer's facility. If the time-reference that is captured on the NVM can be accurately related to actual time, then engine faults stored in the NVM can be helpful in determining the engine status during an accident sequence. If the FADEC is powered, and only airframe faults and no engine faults are captured in the NVM, then it can be surmised that there were no deficiencies associated with the engine. Airframe faults, particularly faults related to components that provide input data to the FADEC may help establish the engine mode of control at the time of the occurrence. The stored airframe faults may help to establish the serviceability of the airframe during the accident flight. Analysis of the FADEC stored faults determined the SR 111 mode of control of the engines and also provided some altitude and airspeed reference information during the last minutes of flight.

1.19.9 Restoration and extraction of non-volatile-memory information

Many of the LRUs contained information within their NVM that could have been of use to the investigation, especially since the flight recorders stopped nearly six minutes prior to the time of impact. None of the LRUs of interest (FCCs, ADCs, etc.) were recovered intact. However, hundreds of loose circuit boards were recovered in various states of damage; many of the components were either partially or completely stripped from the circuit boards. Because the memory chips are not given any particular distinctive markings, identifying specific chips on circuit boards was very difficult and at times impossible. Honeywell, the manufacturer of the majority of the avionics used on the MD-11, provided technical assistance in identifying these NVM memory devices. It would aid accident investigations if the manufacturers of NVM devices could make them more distinguishable, either through colour coding or other markings.

Of the hundreds of circuit boards examined, only one FCC board still contained an EEPROM microcircuit. The device was damaged, predominately from corrosion and required highly specialized techniques to reconstruct it, including the FIBs technique previously discussed. Because of one stuck address, the memory was extracted in two phases. The second phase repaired the stuck address and the remaining half of the data was recovered.

The extracted data was passed to Honeywell for validation and interpretation. The data contained an ASCII representation of the contents of the maintenance memory EEPROM contained in the central processing unit 1A processor of one of the two FCCs installed on the aircraft. It is not known in which position the FCC was installed: left versus right or FCC-1 versus FCC-2.

Evaluation of the data showed three faults were logged on SR 111, on 3 September 1998 at 0124 UTC at an altitude of 11 328 feet and an airspeed of 321 knots. These were AOA-B TST (angle of attack-B test), AOA INV (angle of attack invalid) and FLAP POS INV (flap position invalid). All three faults are related to a loss of power; however, as the FCC position could not be determined, the faults cannot be isolated to a specific angle of attack vane or flap synchro.

1.19.10 Use of computer fire modelling

To complete the fire investigation, there was a requirement for a better understanding of the effects, or lack thereof, of numerous variables. The TSB elected to further advance its fire investigation by incorporating the knowledge gained from the fire tests conducted at the Aircraft Fire Safety Section at the FAA's William J. Hughes Technical Center in Atlantic City, New Jersey, into a computer model. Using the computer model, additional work was completed to analyze fire dynamics using fire field modelling techniques.

Field models are based on an approach that divides the region of interest into a large number of small elemental volumes. These volumes are each systematically analyzed in increments to determine the overall effect or effects. The approach is computationally intensive and complex, but provides superior results when compared to other techniques, such as zone models, that take a much more simplistic approach to the number and size of elemental volumes analyzed. In the SR 111 occurrence, factors such as complex airframe and duct system geometries necessitated a fire field analysis approach, as opposed to a zonal approach.

The investigation of the Swissair Flight 111 (SR 111) occurrence was complex, and involved prolonged wreckage recovery operations before the detailed examination and assessment of the technical issues could be completed. To permit an assessment of the fire-damaged area and to enable evaluation of the potential safety deficiencies, it was necessary to rebuild a portion of the front section of the aircraft. It was found that the extensive damage from the in-flight fire and impact with the water had either obscured or destroyed much of the information from many of the components in this area. However, through detailed examination, reconstruction, and analysis of the recovered components and material, potential fire scenarios were developed. The reconstruction mock-up—together with information from the evaluation of airflow, material properties, and timing of events—led to an understanding of how and where the flammable materials could have ignited and how the fire propagated.

The time interval between when an unusual smell was detected in the cockpit and when the aircraft struck the water was only about 20 minutes; therefore, considerable emphasis was placed on making determinations about the cues available to the crew and the factors affecting their assessment of the on board situation.

2.1 General information

SR 111 departed New York on a regularly scheduled flight, and was being flown by a qualified crew in accordance with applicable regulations and procedures. Documentation indicates that the aircraft was equipped, maintained, and operated in accordance with applicable Joint Aviation Authorities (JAA) regulations.

Records did not reveal any pre-existing medical condition that could have affected the performance of the SR 111 flight crew. Prior to departure, the pilots were reportedly well rested and in good spirits. The crew had received the required duty rest prescribed by regulations; fatigue was considered to not have been a factor in this occurrence.

At some point along the flight route, a failure event occurred that provided an ignition source to nearby flammable materials leading to an in-flight fire. The fire spread and increased in intensity until it led to the loss of the aircraft and human life. The primary factors involved in this occurrence include

• the condition that resulted in the ignition source;
• the flammable materials that were available to be ignited, sustain, and propagate the fire;
• the subsequent fire-induced material failures that exacerbated the fire-in-progress;
• the lack of detection equipment to enable the crew to accurately assess the source and significance of the initial smoke; and
• the lack of appropriate in-flight firefighting measures required to deal successfully with the smoke and fire.

Although data confirms that in-flight fires that result in fatal accidents are rare, many of the same factors listed above were not unique to this aircraft model, airline, or crew.

All ground-based navigation equipment was reported to be serviceable and functioning normally. The Aircraft Firefighting Services at Halifax International Airport were alerted and responded in a timely manner to the vehicle standby positions on the airfield.

The high-energy collision with the water, and the destruction of the aircraft, precluded a complete and detailed inventory of the aircraft's structure and components. However, measuring by structural weight, 98 per cent of the aircraft was recovered. All extremities of the aircraft surfaces were accounted for in the main wreckage field on the ocean floor, indicating that the aircraft was intact when it struck the water.

The search and rescue response was rapid and comprehensive. The disaster response, which involved multiple government departments and agencies, and local citizens was implemented in a timely and effective manner.

The Swissair security policies, procedures, and practices that were in place at John F. Kennedy (JFK) International Airport for the SR 111 flight were examined by the Royal Canadian Mounted Police (RCMP) and Transportation Safety Board of Canada (TSB) investigators. No shortfalls were found. Aircraft and passenger security was not an issue in this occurrence.

All recovered aircraft-related material was examined by fire and explosion experts from the RCMP; they discovered no evidence to support the involvement of an explosive or incendiary device, or other criminal activity.

The coordination between the pilots and the cabin crew was consistent with company procedures and training. The crew communications reflected that the situation was not being categorized as an emergency until about six minutes prior to the crash; however, soon after the descent to Halifax had started, rapid cabin preparations for an imminent landing were underway.

2.2 On-board data recording capability

2.2.1 General

Significantly more recorded information could have been readily available with improved on-board data capture equipment. Improvements in the quantity and quality of recorded information can significantly shorten the investigation duration, and increase the opportunities for identifying safety deficiencies.

2.2.2 Cockpit voice recorder

2.2.2.1 Cockpit voice recording duration

The 30-minute cockpit voice recorder (CVR) recording on SR 111 was insufficient to provide the amount of data needed to fully analyze all of the factors that may have played a part in the occurrence or that could have led to the identification of further safety deficiencies. Longer audio recordings can provide additional background information to assist in assessing the relevance and importance of events, isolating the information that has a direct bearing on the occurrence, and resolving investigation issues more quickly. In the absence of audio recordings, such evaluations using other means can consume considerable time and resources. A minimum two-hour CVR recording capability would have enabled a quicker and possibly more in-depth assessment of events that occurred earlier in the flight. For example, the investigation would have benefited considerably if CVR information had been available to help analyze earlier events such as the time period of the 13-minute, very-high frequency (VHF) communications gap.

The JAA has implemented Joint Aviation Requirements (JAR)-OPS 1.700, which require that airline transport category aircraft certified after 1 April 1998 be equipped with a two-hour CVR recording capacity. However, the MD-11 was certified in 1991; therefore, only a 30-minute recording capacity for SR 111 was required and applied under JAR-OPS 1.710. The United States of America and Canada still only require a 30-minute CVR duration for transport category aircraft.

2.2.2.2 Recorder electrical power source

Had the CVR been equipped with an independent power source to allow for continued operation after its aircraft electrical power source was lost, the resulting additional recorded information could have facilitated a more thorough understanding of the circumstances faced by the crew in the final minutes prior to the crash, and permitted an evaluation of the associated potential safety deficiencies.

In aircraft where the CVR and the flight data recorder (FDR) are both powered from the same aircraft generator bus, both recorders would stop recording at the same time if that generator bus went off-line. Although the current requirement to power the recorders from the most reliable bus available seems prudent in principle, it leaves both recorders vulnerable to a single-point electrical failure. Powering the recorders from separate buses, with some separation of the wiring and separation of respective circuit breakers (CB), would provide an opportunity for one recorder to remain powered in the event of the loss of a bus, and therefore, improve the likelihood that additional useful information would be recorded.

2.2.2.3 Clarity of CVR recording

Some portions of the recording from the cockpit area microphone channel of the CVR that were potentially important to the investigation were difficult to decipher. Experience with numerous other CVR recordings confirms that it is significantly easier to decipher the words when flight crews use their boom microphones. The improved clarity results in significant time saving during investigations, increased transcription accuracy, and higher likelihood of identifying and validating safety deficiencies. Currently, there is no regulatory requirement for the use of boom microphones in all phases of flight, nor is such usage standard practice among airline companies.

2.2.3 Survivability of quick access recorder information

As is typical with most quick access recorders (QAR), the QAR in SR 111 recorded significantly more data than did the FDR. The QAR tape was damaged beyond use; therefore, no information was available from this potentially valuable source. The number of parameters that would have been recorded on the SR 111 QAR exceeded by fourfold those that were recorded on the FDR. Some of those parameters included temperatures in some of the hidden areas and electrical voltages of various aircraft systems. Such information, if stored on the crash-protected FDR, would have been useful to the investigation by providing significant clarification regarding the ignition source and propagation of the in-flight fire.

Modern digital FDRs are technically capable of recording all QAR data from various aircraft sources in a crash-protected environment; however, there is no regulatory requirement that modern FDRs record QAR data.

2.2.4 Image recording

Although regulations do not require the recording of cockpit images, it is technically feasible to do so in a crash-protected manner. Recorded images could provide additional valuable information about crew actions, equipment failures, settings, selections, aircraft flight display information, location of smoke, and other elements that could help more clearly ascertain what took place. Such information could be used to more quickly and effectively determine what happened so that safety deficiencies are more reliably identified.

Much of the interaction that occurs within the cockpit is done by non-verbal means. Without recorded cockpit images, information must be gleaned and deduced by piecing together information from observations made during wreckage examination, and from the CVR and FDR recordings. Although the information obtained from these recording devices can be of significant value, the recordings often provide only partial and unclear information. Frequently, the information does not provide the context of the events, or does not provide sufficient detail for efficient and effective safety investigation purposes. Recorded cockpit images on SR 111 would have provided useful additional information, and added clarity to the understanding of the sequence of events.

2.2.5 Underwater locator beacons – Bracket attachments

The underwater locator beacon (ULB) bracket attachments for the flight recorders remained attached to the recorders; however, the ULBs were damaged to the extent that they had nearly detached. Had the ULBs detached from the recorders, there would be a risk of delaying or preventing the recovery of the recorders. Existing regulations do not require that ULB attachments meet the same level of crash protection as other data recorder components.

2.3 Material susceptibility to fire – Certification standards

2.3.1 Flammability of materials

The most significant deficiency in the chain of events that resulted in the crash of SR 111 was the presence of flammable materials that allowed the fire to ignite and propagate. Testing conducted during the investigation showed that several materials located in the heat-damaged area were flammable, even though they met regulatory standards for flammability. The metallized polyethyelene terephthalate (MPET)–covering material on the thermal acoustic insulation blankets (insulation blankets) used in the aircraft was flammable. This was the most significant source of the combustible materials that contributed to the fire. The MPET–covered insulation blanket was also most likely the first material to ignite. Other materials in the area of the fire damage were also found to be combustible and to have contributed to the propagation and intensity of the fire. These materials included silicone elastomeric end caps; hook-and-loop fasteners; foams; adhesives; and different kinds of splicing tapes used in the construction, installation, and repair of insulation blankets.

The certification testing procedures mandated under flammability standards that existed at the time of the occurrence were not sufficiently stringent or comprehensive to adequately represent the full range of potential ignition sources. Nor did the testing procedures replicate the behaviour of the materials when installed in combination, or in various locations and orientations, as they are found in typical aircraft installations and realistic operating environments. The lack of adequate standards allowed materials to be approved for use in aircraft, even though they could be ignited and propagate flame.

Two primary factors shaped the flammability standards in place at the time of the occurrence.

1. The approach taken by the Federal Aviation Administration (FAA) in the mid-1970s to concentrate its fire prevention efforts in the following two areas: improved cabin interior materials and higher standards for materials in designated fire zones.
2. A lower priority assigned to fire threats in other areas. The non-fire-zone hidden areas were viewed as benign from a fire hazard perspective, as they were seen to be free of the combination of the two elements needed for a fire: a potential ignition source and flammable materials.

The ground fire incidents involving the MPET and non-metallized polyethylene terephthalate insulation blanket cover material that led McDonnell Douglas to reassess its flammability testing of insulation blankets did not trigger mitigating action by regulators. Testing by the manufacturers, the Civil Aviation Administration of China (CAAC), and the FAA showed that these materials could ignite and burn; however, the FAA's follow-up on this issue did not include mandating action to mitigate the potential fire threat. Although McDonnell Douglas stopped using MPET-covered insulation blankets in its production aircraft, and issued a Service Bulletin recommending that operators replace it with a different material, neither the FAA nor other airworthiness authorities required its removal from in-service aircraft until after the release of the safety recommendations made by the TSB following the crash of SR 111.

In 1996, the CAAC pointed to the flammability of the materials as a safety issue in its investigations into two separate in-flight fire occurrences. However, other investigations involving aircraft fires in which MPET-covered insulation blankets were involved typically focused on the ignition source rather than the flammable material. Those investigations did not highlight the safety deficiency posed by the flammable materials.

Ultimately, the in-service flammability performance of MPET-covered insulation blankets prompted an FAA-led research program to quantify the deficiency and develop a specific flammability test for thermal acoustic insulation materials. More than two years of research resulted in the FAA proposing the adoption of the more stringent test, entitled the Radiant Panel Test (RPT). This test exposes the materials to a more realistic in-flight fire scenario and effectively imposes a "zero" burn requirement. Validation of the RPT confirmed that MPET-covered insulation blankets were highly susceptible to flame propagation when ignition occurs from a small ignition source. This confirmation prompted the FAA to issue Airworthiness Directives (AD), applicable to US-registered aircraft, that state that "a determination be made of whether, and at what locations, metallized polyethylene terephthalate (MPET) insulation blankets are installed, and replacement of MPET insulation blankets with new insulation blankets" and "[t]he actions specified by this AD are intended to ensure that insulation blankets constructed of MPET are removed from the fuselage." Although these ADs are enforceable only with respect to US-registered aircraft, most other regulatory authorities throughout the world generally follow the FAA's lead and endorse FAA ADs.

While MPET-covered insulation blankets are identified as the most vulnerable, the research also established that many other widely used thermal acoustic insulation cover materials did not meet the requirements of the RPT. Furthermore, the ADs that call for the removal of MPET-covered insulation blankets warn that other cover materials, although harder to ignite, burn in a similar manner as MPET-covered material. The TSB has expressed concern about the flammability characteristics of other materials that were approved under the same testing procedures used to certify the MPET. Many of these cover materials have been shown to be flammable in subsequent testing.

Most aircraft crews are likely unaware that under certain conditions, a fire could ignite significant flammable materials in hidden areas of aircraft and spread rapidly. Had the pilots been aware that flammable materials were present in the attic space of the MD-11, this knowledge might have affected their evaluation of the source of the odour and smoke.

2.3.2 Contamination issues

Several Swissair MD-11s were inspected for potentially flammable contaminants in the area where the fire is believed to have started; little or no contamination was observed in this area. It was determined by testing that the materials involved in the initiation of the SR 111 fire were flammable in their newly installed condition; therefore, contamination was discounted as a factor in the initiation of the fire.

Although it is intuitive that the presence of contamination on the surface of a material could have a negative affect on its flammability characteristics, additional testing is required to quantify the risk.

2.3.3 Non-fire-hardened aircraft systems

Prior to the time of the SR 111 occurrence, regulators and manufacturers perceived minimal in-flight fire threat in areas other than the passenger cabin areas and designated fire zones. Therefore, certification standards did not account for the potential consequences of a fire-related breach or failure of an aircraft system in areas such as the attic space. This deficiency allowed systems to be constructed in a way that a fire-related component failure could potentially exacerbate the fire.

In a fire environment, a breach in a system, such as the hydraulic, oxygen, or air environmental systems, could significantly add to the severity of the fire by increasing the amount of combustible material, adding oxygen, or modifying the airflow in the area. For aircraft certification, defences against such failures are typically put in place as a result of a system safety analysis of the potential hazards. The system safety zonal analysis conducted on the MD-11 for the area where the fire occurred in SR 111 did not include the hazards resulting from system or component failures caused by a fire-in-progress. Regulations did not ensure that such hazards be included in the system safety analysis. The breach of an elastomeric end cap in the air conditioning duct system, and possibly a failed aluminum cap in the flight crew oxygen system, would have allowed these systems to exacerbate the in-flight fire.

2.4 Aircraft fire detection and suppression

Large transport aircraft are designed according to a standard that requires built-in fire detection and suppression systems only in designated fire zones, such as engines and auxiliary power units, and in potential fire zones, such as lavatories and cargo compartments. That is, only in these areas are risks from the combination of potential ignition sources and flammable materials recognized to co-exist to the extent that detection and suppression systems are required by regulation. Other areas, such as in the hidden areas above the cockpit ceiling and cabin attic space in the MD-11, have been shown to be at risk from fire because they also contain flammable materials and potential ignition sources. The FAA was aware of the existence of flammable materials and potential ignition sources in these areas; however, it assessed the risk of fire as minimal. Current standards do not require these areas to have built-in smoke/fire detection and suppression features. Therefore, detection of smoke or fire in other than designated fire zone and potential fire zone areas is totally reliant on human sensory perception. In areas such as the attic space, normal airflow patterns and highly effective air filtering systems can isolate odours or smoke, and significantly delay their detection.

The MD-11 was not required to have built-in fire suppression features in areas other than the designated fire zones and potential fire zones. Nor was the aircraft required to have access panels or other alternative methods to allow for firefighting in hidden areas. Without built-in fire suppression, or access to currently inaccessible areas by crews to use fire extinguishing equipment, the opportunities to control fires in those areas are limited. Even if the SR 111 crew had known the source of the smoke early in the event, it would have been a significant challenge for them to gain access to the attic area where the fire was underway. By the time the general location of the fire became known in the last few minutes of the flight, it would have been unlikely that they could have accessed the attic area and been able to control or extinguish the fire using the hand-held fire extinguishers. It is unknown whether such an attempt was made.

Initially, the crew was unaware that smoke was present in the hidden areas above the cockpit ceiling and cabin attic space. After the smoke was detected in the cockpit, communications took place between the pilots and the cabin crew. However, there was no recorded mention of smoke having been detected in the cabin at any time before the CVR stopped recording. If smoke had been detected in the cabin area, it is expected that the cabin crew would have relayed this information to the pilots.

Reliance on human detection was inadequate, as the location and extent of the smoke and fire was not discerned by the aircraft crew until the fire was uncontrollable using available firefighting means. The crew members were significantly hampered in their ability to deal with the fire situation owing to the lack of built-in detection and suppression equipment in the area of the fire.

2.5 In-flight firefighting masures

At the time of the SR 111 occurrence, the aviation industry (manufacturers, regulators, operators, and associations) did not treat the issue of in-flight fire protection as a "system" of inter-related measures; that is, there was no requirement for an overall assessment of various fire-related defences. Such an assessment would examine the interactions between the crew, the procedures, the materials and equipment, and would take into account how the various elements could work together to prevent, detect, control, and eliminate fires. In such an approach, separate elements would be evaluated together in a harmonized manner, including material flammability standards, accessibility into hidden areas, smoke/fire detection and suppression equipment, crew emergency procedures, and training.

No major initiatives had been established to assess all components together, or to evaluate their inter-relationships with a view to developing improved, coordinated, and comprehensive firefighting measures. There was a lack of integration of the various potential measures to combat in-flight fires.

Lessons learned from accidents involving in-flight fires have resulted in various changes to flight procedures and aircraft equipment design.^{Footnote 115} However, the changes aimed at providing better firefighting measures have generally been made in isolation, rather than in a fully integrated and comprehensive manner. Considerable industry efforts have been made to prepare and equip aircraft crews to handle some types of in-flight fires (e.g., readily accessible passenger cabin fires). However, these efforts have fallen short of adequately preparing aircraft crews to detect, locate, access, assess, and suppress in-flight hidden fires in a rapid, coordinated, and effective manner.

2.6 Crew preparation and training

2.6.1 In-flight firefighting

The training received by the crew of SR 111 was consistent with industry norms; however, it did not prepare them to recognize or combat the in-flight fire. Pilot training focused on eliminating the threat from smoke in the aircraft, whether from an air conditioning or electrical source, by using the checklists provided. It was not anticipated within the aviation industry that aircraft crews could be confronted with a fire in the attic area of an aircraft. Neither were crews trained to appreciate how quickly in-flight fires can develop into uncontrollable situations. Instead, simulator training tended to reinforce a positive outcome to smoke-related events; typically the actions taken by the pilots during the simulator exercise would result in the smoke quickly dissipating. Procedures and pilot training were typically based on the premise that potential ignition sources can be successfully dealt with by procedures that isolate the source. There was little emphasis on the possibility that a fire may have already started by the time smoke is detected, or that once a fire has started, it may not be isolated or eliminated by existing checklist procedures.

At the time of the SR 111 occurrence, there was an expectation within the industry that crews would be able to distinguish, with a high degree of certainty, between smoke emanating from an air conditioning source and smoke being generated by an electrical malfunction. At Swissair, it was felt that once the pilots had made this distinction, and they were certain that the source was related to air conditioning, it would be appropriate to select the Air Conditioning Smoke checklist. However, it is an invalid assumption that human sensory perception is capable of consistently differentiating between smoke initiated by an electrical source, by an air conditioning source, or by the by-products of the combustion of other materials.

Swissair flight crews trained together with cabin crews and met industry standards for dealing with readily accessible fires in the passenger cabin area, such as fires in galleys or lavatories. None of the firefighting training included firefighting in the cockpit, avionics compartment, or in hidden areas behind panels or above the cockpit or cabin ceiling area. In general, pilots are not expected to leave their flying duties to engage in firefighting outside the cockpit. This expectation is consistent with industry norms, which dictate that the cabin crew fight the fire so that the pilots can continue to fly the aircraft.

The flight crews were trained to react to emergencies with a measured response, commensurate with the perceived threat. The SR 111 pilots would be expected to react to the appearance of the smoke by completing the Power, Performance, Analysis, Action functions, and by developing and executing a plan of action based on their appreciation of the situation. Although this item was discussed and pointed out in the respective simulator training sessions, no specific training or direction was provided regarding the urgency of starting a checklist and confirming by all possible means the type and seriousness of a smoke or fumes event.

Cabin crews were trained to locate and extinguish in-flight fires, but their training was limited to those areas of the aircraft that are readily accessible. This training would not prepare cabin crew members for firefighting in the attic area or other hidden areas. Further, cabin crews were not specifically trained to fight fires in the cockpit or avionics compartment area.

2.6.2 In-flight emergency diversions

Swissair pilots were directed, through information provided in the Swissair General/Basics: Flight Crew Manual, to land at the nearest emergency airport if confronted with persistent smoke from an unknown source. These directions did not indicate that an emergency diversion was to be initiated immediately, or that any smoke should be assumed to be an in-flight fire until proven otherwise. Therefore, in the presence of smoke, crews were expected to classify the smoke, select the appropriate checklist, and divert the aircraft when warranted.

The SR 111 pilots quickly investigated the situation and made a timely decision to divert the flight, even though, based on the perceived cues, the situation was not classified as an emergency.

2.7 Checklist issues

2.7.1 Swissair checklist options for smoke isolation

The issue of having two, versus one, emergency smoke isolation checklist was examined to assess whether having a choice between two checklists could have affected the outcome of the occurrence. For this to have been a factor, it would have to be assumed that the pilots would have reacted differently had Swissair procedures incorporated a single checklist for smoke/fumes of electrical, air conditioning, or unknown origin. The pilots assessed the smoke to be from an air conditioning source and did not deem the smoke to be enough of a threat to complete the Air Conditioning Smoke checklist. Therefore, it seems unlikely that the pilots would have performed the single checklist any earlier.

Providing a choice of two emergency smoke checklists to deal with smoke isolation presupposes that it is possible to assess the type of smoke with certainty. The SR 111 occurrence illustrates that an accurate evaluation of smoke type is not always possible using human sensory perception.

2.7.2 Emergency electrical load-shedding

The pilots initially assessed that the smoke was originating from an air conditioning source. Having made this determination, there is no indication that they immediately initiated any checklists. Even if they began immediately with the Smoke/Fumes of Unknown Origin Checklist, it would not likely have affected the fire scenario, as the fire is believed to have been self-propagating by the time the smoke appeared in the cockpit. However, there are circumstances where a rapid de-powering of electrical systems might prevent a fire by removing the ignition source before any combustible materials ignite.

No regulatory requirement exists for transport category aircraft to be designed to allow for a checklist procedure that de-powers all but essential electrical equipment for the purpose of eliminating a potential ignition source. Checklists that are used for electrical load-shedding, such as the MD-11 Smoke/Fumes of Unknown Origin, are intended to isolate a malfunctioning component that is generating smoke or fumes. The associated checklist actions could take up to 30 minutes or more, depending on how early in the checklist procedure the malfunctioning component is deactivated.

No regulatory requirement exists to govern the length of time that checklists designed to deal with odour or smoke events could take to complete. The 20 to 30 minutes typically required to complete the Smoke/Fumes of Unknown Origin Checklist in the MD-11 could allow an electrical malfunction that is generating smoke and increasing heat energy to develop into an ignition source. To be effective in helping prevent the initiation of a fire, a checklist procedure must quickly eliminate the ignition source before a fire has become self-sustaining.

2.7.3 Additional checklist issues

The deviations noted with the Swissair Smoke/Fumes of Unknown Origin Checklist had the potential to be problematic. However, the only direct connection that could be established with the SR 111 scenario was the darkened cabin that resulted from the emergency lighting in the passenger cabin going off when the CABIN BUS switch was selected by the pilots. Working in a darkened cabin could have delayed the cabin crew preparations for an emergency landing by necessitating the use of flashlights. However, there was a cabin emergency lights switch installed at the flight attendant station normally occupied by the maître de cabine (M/C). The use of this switch would have restored the emergency lighting and eliminated the need to temporarily use flashlights. It is unknown whether this cabin emergency light switch was used.

There is no indication that the decisions made by the pilots were affected by the absence of direction in the checklist to don oxygen masks. It is unknown whether the pilots would have initiated an emergency diversion earlier if there had been a single, combined checklist with one of the first items being related to preparing to land expeditiously. It could not be determined whether they were inhibited by the size of the font or any glare from the checklist, although either of these conditions could affect the ability of flight crews to read the checklist, especially in a smoke or low-light environment.

A review of several checklists showed a lack of emphasis on treating any amount of smoke in an aircraft as a serious fire threat. For example, neither the Swissair nor the McDonnell Douglas Smoke of Unknown Origin Checklist stipulated that preparations for a possible emergency landing should be considered immediately when smoke of unknown origin appears. Rather, on both versions, the reference to landing is the last action item on the checklist. Similarly, the Swissair guidance provided to flight crews was that the aircraft was to land at the nearest emergency airport if smoke of unknown origin was "persistent."

2.7.4 Checklist revisions and approvals

Swissair representatives consulted with McDonnell Douglas when they decided to retain two MD-11 smoke checklists and revise the Smoke/Fumes of Unknown Origin Checklist; however, no formal change approval was required by the Swiss Federal Office for Civil Aviation (FOCA).

2.8 Maintenance and quality assurance aspects

During the investigation, the maintenance condition of the aircraft was assessed by reviewing the aircraft's maintenance records and SR Technics maintenance policies, procedures, and practices.

The records for the occurrence aircraft indicate that required maintenance had been completed, and that the aircraft was being maintained in a manner consistent with approved maintenance procedures and industry norms. Although several "bookkeeping" anomalies were found, the overall method of record-keeping was sound.

The condition of the SR 111 wreckage did not allow for a full determination of the pre-occurrence condition of the aircraft. Therefore, investigators inspected several MD-11s, including those in the Swissair fleet, and used the information from these inspections to help assess the potential ignition sources. During these inspections of the MD-11s, various discrepancies were noted in the installation and maintenance of the electrical system, including chafing on wires, incorrectly torqued terminal connections, and inconsistent wire routing. None were considered to affect the immediate safety of flight. Some of the discrepancies could be attributed to the manufacturer of the aircraft, and others to subsequent installations and ongoing maintenance.

The SR Technics quality assurance (QA) program satisfied regulatory requirements. It involved a multi-faceted approach that relied on training, trend analysis, reliability, and structured audits. The number and type of anomalies discovered during the investigation, which included a review of the findings of the various internal and external audits, suggest that while the QA program design was sound, its implementation did not sufficiently ensure that potential safety aspects were consistently identified and mitigated.

The SR Technics maintenance organization exposition (MOE) required that all employees be trained to be personally responsible for the quality of their work; that is, the work was expected to be accomplished correctly, and a self-inspection was to be completed after each "work step." Whenever work was carried out where the consequences of a mistake in doing the work presented a risk to persons or material (as determined by a risk assessment team), a double inspection was called for. Supervisors were to ensure that the QA program was being followed, and were to inspect the quality of the work in their area of supervision. Individuals received general QA instructions and familiarization training on documentation, policies, and procedures, but did not receive (nor did the MOE make reference to) specific training on how to consistently implement the QA program. The primary task of those involved in the day-to-day QA activities was to maintain the aircraft. There are indications that they dealt with some of the various technical discrepancies and anomalies as reliability issues rather than potential safety deficiencies. Although regulatory requirements were met, some aspects of the QA program were not consistently implemented.

A post-occurrence SR Technics review of its own QA program determined that a weak link in its program was the reliance on individual judgment. This observation had not been made in any of their previous internal audit findings. Although judgment plays a role in any QA program, it appears that the SR Technics QA program was over-reliant on the ability of individuals to identify potential safety deficiencies while they continued to try to meet productivity targets.

Although the SR Technics QA program had a follow-up process for safety issues, as defined in the MOE, the implementation of the program was such that opportunities to identify potential safety issues were at times missed; as a consequence, safety-related follow-up was not undertaken on these occasions. For example, the map light anomalies were handled as a reliability issue; they were not identified as having flight safety implications.

The investigation did not attempt a direct comparison study to determine how the SR Technics QA program compared to QA-related programs at other operators. However, information was available from an FAA National Program Review report in which it completed a review of the maintenance organizations of nine of the largest S airlines.^{Footnote 116} The observations suggest that shortcomings identified in the SR Technics QA program were not unique. The FAA concluded that while the current state of the mandated QA-related programs in those nine airlines did not constitute an unsafe condition, each of them would benefit from reviewing and adapting their individual QA programs with the FAA's optimized model of the Continuing Analysis and Surveillance System (CASS) program. Similarly, analysis of the SR Technics QA program did not identify immediate flight safety concerns or unsafe conditions, although the program was not always effective in highlighting and resolving potential safety-related aspects.

The observations of the National Program Review results, by the US Department of Transportation's Office of the Inspector General (OIG), were of interest to this investigation. The OIG concluded that, in its oversight of the various CASS programs, the FAA focused primarily on whether the program had all the required elements, rather than on whether it was effective in detecting potential problems. The OIG made various recommendations that would require improved training, monitoring, and analysis of the CASS program. Analysis of the results of the FOCA audits of SR Technics showed a similar trend.

The similar nature of various FOCA audit findings indicates that they concentrated on ensuring that the QA program had the required elements. The findings tended to identify symptoms, rather than the underlying factors manifested in the recurring findings. Typically, the audits each contained several findings that questioned the adequacy and quality of personnel training, or the implementation and compliance of established practices and procedures. The FOCA accepted SR Technics' corrective actions, but made similar findings on subsequent audits. It was also noted that typically, the FOCA findings were comparable to those of the internal SR Technics audits.

See the supporting technical information on this topic.

2.9 Potential effect of high-intensity radiated fields

The MD-11 certification process included tests to demonstrate an acceptable level of aircraft systems protection against the effects of high-intensity radiated fields (HIRF). The test conditions represented radiated field strengths that vastly exceed the maximum field strengths produced by all known commercial and military radars that were operating in proximity to the occurrence aircraft. Similarly, no hypothetical combination of known emitters and realistic distance separation geometry can be shown to exceed the field strength criteria used during MD-11 HIRF certification testing.

After leaving the airspace of JFK airport, the most significant HIRF environment encountered by SR 111 was in the vicinity of Barrington, Nova Scotia. The HIRF field strength near Barrington, in the environment external to the aircraft, was approximately 100 times weaker than the estimated peak field strength encountered by aircraft during normal approach and landing conditions at typical large, well-equipped airports. Therefore, it is probable that the normal operating environment around JFK airport was the most severe HIRF environment encountered by the aircraft during any portion of the occurrence flight.

The normal HIRF environment at JFK airport does not represent a hazard to aviation, as demonstrated by the uneventful arrival and departure of many aircraft each day, including previous flights by the occurrence aircraft. In addition, the minimum field strength required to induce an electrical discharge between exposed conductors (31 kilovolts per centimetre at sea level) is more than 1 000 times greater than the peak field strength associated with normal airport HIRF environments, and about 430 times greater than the theoretical worst-case HIRF environment for a commercial aircraft.

Resonance effects could not have produced localized field gradients of sufficient strength to induce an electrical discharge between exposed conductors. The required gain factor to the ambient field strength is approximately three orders of magnitude (about 1 000 times greater), whereas resonance gain factors rarely exceed one order of magnitude.

Radio frequency (RF) spectrum allocations are developed to ensure that authorized high-power RF sources will not interfere with aircraft radios and radars; therefore, it is unlikely that the 13-minute communication gap was caused by interference from a HIRF emitter. In any case, no technically feasible link exists between HIRF-induced VHF radio interference and an electrical discharge event leading to the ignition of flammable materials. Therefore, HIRF was considered not to be a factor in this occurrence.

2.11 ACARS and VHF communications gap anomalies

Anomalies with the aircraft communications addressing and reporting system (ACARS) were evaluated for any possible connection to the technical failure event that preceded the in-flight fire. The first indication of an ACARS anomaly was the non-recording of the ACARS tracker message at about 0031:18, more than 39 minutes prior to the detection of the unusual odour in the cockpit (see Section 1.18.8.2).

The two ACARS tracker messages that were expected at about 0031:18 and 0041:18 were not recorded by the ACARS system providers; however, the count update information obtained from subsequent ACARS messages shows that these two messages had been sent from the aircraft. The most plausible explanation is that the ACARS system logged onto another network, as would happen if the system that was initially being used became saturated. No data was available to confirm this hypothesis.

The communications system in the MD-11 incorporates redundancy, in that it has three VHF communication paths available. It would take a complete failure of the entire system before communication capability would be lost. This could happen with a failure of the digitally controlled audio system (DCAS); however, this eventuality is unlikely in that the DCAS worked normally after communication had been re-established. The only other circumstance that would completely disable the communications system would be the simultaneous failure of all nine push-to-talk switches; this is considered unfeasible. Therefore, it is highly unlikely that the communications gap was related to a technical failure.

The most plausible explanation for the 13-minute communications gap is that the pilots selected an incorrect frequency during the attempted frequency change between 0033:12 and 0033:21. The communication sequence leading up to this frequency change differed from previous and subsequent frequency changes in that following the first instruction by ATS to change to a different en route frequency, only a short, clipped, unintelligible communication was heard from SR 111. However, when the new frequency assignment was repeated by the controller, SR 111 immediately acknowledged in a normal manner by repeating the assigned frequency. The subsequent keying events on both VHF 1 and VHF 2 that were recorded by the FDR during the communications gap are consistent with attempts by the pilots to re-establish radio contact. As frequency settings are not recorded on the FDR, it is not known which frequency the pilots were attempting to use.

When the pilots eventually re-established contact, it was on an unassigned frequency, and they made no mention of a technical problem. There is no record of any subsequent radio communication difficulties until after the effects of the fire had started to also affect other aircraft systems, about 40 minutes later.

The loss of ACARS on VHF 3 at 0047:06 can be explained by the pilots switching VHF 3 from data mode to voice mode in an attempt to use this radio for communications. The message protocol data from the ACARS provider indicates that the pilots must have switched VHF 3 to voice mode at 0047:06 when the ACARS changed to the satellite mode of transmission; the pilots then switched VHF 3 back to data mode at 0104:14.

The odour in the cockpit of SR 111 was initially detected about 37 minutes after the start of the VHF communications gap, and about 24 minutes after communication had been restored. No connection could be established between the ACARS anomalies, the 13-minute VHF communications gap, and the ignition of the fire in the aircraft.

2.12 Flight crew reading light (Map light) installation

The design deficiencies of the Hella map light resulted in the potential for electrical arcing in typical in-service conditions. Normal rotation of the lens housing allowed contact between the insulating protective cap and the carrier frame; over time, usage would result in damage to the protective cap exposing the positive terminal metal contact spring. This situation provided an opportunity for the exposed metal contact spring to arc to the carrier frame. The design also created at least three additional opportunities for electrical arcing, including during bulb replacement maintenance activity.

Also, the map light installations at the pilot and co-pilot positions in the MD-11, were located in confined areas near, or in direct contact with, combustible materials that could exacerbate the consequences of any potential arcing. The overheat damage observed on several MPET-covered insulation blankets examined in other MD-11s, reflected the heat build-up behind the map lights. The combination of radiant heat and close proximity would increase the probability of igniting the MPET-covered insulation blankets during an arcing event.

The map lights were not involved with the origin of the SR 111 fire; however, the deficiencies found in both the map light design and its MD-11 installation presented unacceptable risk. These safety deficiencies are being eliminated by the follow-up actions underway (see Section 4.1.4).

2.13 Circuit breaker and electrical wire issues

2.13.1 Circuit breaker technology

The arced in-flight entertainment network (IFEN) power supply unit (PSU) cables were protected by conventional CBs typical of those used in the remainder of the aircraft and throughout the aviation industry. Two of the PSU cables (exhibits 1-3790 and 1-3791) had arcing events that did not trip the associated CB. It is most likely that the CBs did not trip because the electrical characteristics of the arcs were outside the defined Time versus Current curve.

Conventional aircraft CB technology can provide protection against hard short-circuit faults, but is limited in that it does not adequately protect against the full range of arc faults.

Industry and government are presently engaged in various research and development efforts aimed at designing a CB that will detect and react to the full range of known arc fault events, including short duration arc faults that typically occur outside the defined Time versus Current curve of traditional CBs. The resulting Arc Fault Circuit Breaker (AFCB) is being designed to surpass the protection provided by traditional thermal CBs. While the new circuit protection devices will mitigate the wire damage from successive arcing events on the same wire, ignition of surrounding flammable material may still occur from the initial arcing event.

Theoretically, had an AFCB been available to protect the IFEN PSU cables, the initial arcing events on exhibits 1-3790 and 1-3791 would have been detected by the AFCB, and the device would have tripped and de-energized the cable.

While the proposed AFCB certification tests will result in improved arc-fault detection capabilities and response times, as written they will not certify the AFCB's ability to prevent the ignition of flammable materials by arcing phenomena. Given the existence of flammable materials used in aircraft construction, it would be prudent to establish AFCB certification criteria based on limiting the arc energy to a level below that necessary to ignite any materials likely to be used in aircraft. Although such testing standards have been incorporated for residential arc fault circuit-interrupters, draft certification test requirements for aircraft AFCBs do not include such criteria.^{Footnote 117}

2.13.3 Circuit breaker maintenance

As a result, in part, of the CB's inherent reliability, preventive maintenance is rare and largely confined to a general visual inspection and cleaning, as required. When a CB experiences a failure, it is typically confined to one of two modes: the CB either exhibits nuisance trips, or it fails to trip when exposed to an over-current condition. Maintenance action in either case is usually confined to replacement of the faulty CB. While both failure modes are undesirable, the failure of a CB to trip leaves the associated wire or cable unprotected. Analysis of the failed CBs has revealed that, in some instances, long periods of inactivity can cause the CB's trip characteristics to change with time.^{Footnote 118}

According to both the FAA and the Society of Automotive Engineers, this CB aging phenomenon can be prevented by the periodic cycling of the CB mechanism. Despite such recommendations, aircraft maintenance programs do not typically include a requirement to "exercise" CBs on a periodic basis. In its recently published bulletin on the issue of resetting tripped CBs, the FAA made no mention of the adequacy of the various operators' CB preventive maintenance programs. Addressing the practice of periodic CB cycling would help those responsible for CB maintenance programs to ensure that their programs are consistent and optimized to provide maximum CB reliability. There is a need for the aviation industry to identify a "best practices" approach to CB maintenance and to ensure that CB maintenance programs are designed appropriately.

2.13.4 Electrical wire separation issues

2.13.4.1 FAR 25.1353(b) requirements

From a wire separation perspective, no linkage was found between the design of the MD-11 wire routing and the source of the ignition for the in-flight fire. However, because all six power bus feed cables are routed together near the overhead switch panel housing, the design provided an increased opportunity for all the services supplied by these cables to be lost as a result of a single-point failure. It was established that the loss of the systems associated with the left emergency AC bus feed cable resulted from the cable being damaged by the fire. The failure of this cable occurred late in the sequence of events when the fire was well developed. Although the loss of associated systems would have compounded the already significant challenges being faced by the pilots, and could have contributed to the loss of control of the aircraft, it is likely that the fire environment, and not the loss of the various aircraft systems, was the crucial factor in the eventual outcome. The design of the MD-11 is such that even if all of these cables become de-powered, there would be limited, but sufficient, capability remaining to allow the pilots to maintain control of the aircraft.

Federal Aviation Regulations (FAR) 25.1353(b) states that "[c]ables must be grouped, routed and spaced so that damage to essential circuits will be minimized if there are faults in heavy current-carrying cables." The objective is to minimize the impact of the failure of a heavy current-carrying cable on any essential system wiring. The wording implies that such minimization measures need only be taken when a wire bundle contains both essential systems wire or wires and heavy current-carrying cable or cables. The guidance material does not specify what measures would be acceptable to meet the requirements of FAR 25.1353(b). Neither does FAR 25.1353(b) specifically address, from a wire separation perspective, the acceptability of grouping or bundling power cables that may be deemed to be part of the essential system wiring. In addition, interpretation of this regulation is made more difficult because several terms, such as "essential circuits," are not defined by the regulator.

In aircraft design, it is not always possible to maintain physical separation between wires, especially in the cockpit area where, typically, space available for installations is confined. There are no clear guidelines about what would constitute an alternate means of achieving compliance when physical separation is not practical or possible. For the MD-11, the manufacturer used protective sleeving, and considered it capable of providing an equivalent level of safety to physical separation. As there has been no history of problems in the MD-11 or DC-10 fleet over many years of service, this method has evidently served the purpose; however, neither the MD-11 manufacturer nor the FAA has quantified the effectiveness of such protective sleeving.

The lack of clarity of the guidance material is highlighted by the difficulty in making compliance determinations about how the routing of the emergency and battery power bus feeds in the MD-11 should be viewed. That is, if FAR 25.1353(b) applies to the wires in question, it is unclear whether the wire bundles are permitted to contain essential system wiring along with the heavy-current-carrying cables, even for short lengths. For example, the wire run near the overhead switch panel housing might be interpreted as not complying with FAR 25.1353(b), because physical separation was not achieved; however, the FAA's interpretation of this installation was that the wire run complied. The basis for this interpretation is not clear in that there is no specified method of providing for an alternate means of compliance to FAR 25.1353(b) for cases where physical separation is not practicable or workable. A review of the regulations and guidance in this area would be appropriate.

2.13.4.2 Electrical wire insulation mixing

The FAA recognizes that mixing of wires whose insulation materials have different hardness characteristics can cause damage, especially in high-vibration areas. While there are no regulations pertaining to the mixing of wire insulations, FAA ACs 43.13-1B and 25-16 provide some guidance. AC 43.13-1B constitutes a general guide that provides acceptable methods, techniques, and practices for aircraft inspection and repair, while AC 25-16 supplements AC 43.13-1B with respect to the topic of electrical fault and fire prevention.

AC 43.13-1B is clear on the issue of wire mixing in that it states the "routing of wires with dissimilar insulation, within the same bundle, is not recommended." AC 25-16 suggests that the mixing of wires with "significantly different" insulation hardness properties should be avoided. Beyond relative wire-to-wire hardness, AC 25-16 also indicates that consideration should be given to the hardness factor between wire insulation and insulation-facing material, such as clamps or conduits.

The FAA relies on the aircraft manufacturer or modifier to establish material compatibility through prior satisfactory service experience or tests. To this end, Boeing's material compatibility tests have established an inventory of wires and insulation-facing material that, in its view, are suitable for use in the same bundles. Boeing-manufactured MD-11 wire bundles were designed and installed in accordance with acceptable industry standards to minimize wire-to-wire chafing damage and damage from wire-facing materials, such as clamps. Although after-market installations, such as in-flight entertainment (IFE) systems, may use the same or similar wire types as used by the aircraft manufacturer, the wire-to-wire compatibility would depend on the quality of the installation.

2.13.4.3 Reporting of wire-related discrepancies

At the time of this occurrence, there was no requirement to report wiring anomalies as a separate and distinct category of discrepancy. Consequently, in many cases, wiring discrepancies were attributed to a component or line replaceable unit within the associated aircraft system. Additionally, many wiring discrepancies are repaired in situ without a full appreciation of the consequences of the anomaly being revealed. The lack of a dedicated Joint Aircraft Systems/Components Inspection Code (enhanced Air Transport Association codes) limited the development of methodologies to collect, compile, and monitor data regarding wire problems for trend analysis. Although more specific wiring information is now being recorded by technicians and regulatory inspectors, and progressively more data are becoming available to facilitate the validation of potential wiring deficiencies, the previous lack of guidance material for reporting wire-related failures resulted in the capture of limited historical data, which continues to hamper the evaluation of the nature and extent of wiring-related safety deficiencies.

2.14 In-flight entertainment network

2.14.1 Operational impact of the IFEN integration

The design philosophy of the MD-11 is such that all "non-essential" passenger cabin equipment be powered by one of eight cabin buses. Activation of the CABIN BUS switch, located in the cockpit overhead switch panel, is designed to isolate all "non-essential" power to the cabin. This action is the first item in the Swissair MD-11 Smoke/Fumes of Unknown Origin emergency checklist and enables the crew to assess whether the smoke is originating from a component associated with the cabin bus system. During the initial review of the IFEN documentation it was determined that the IFEN power supplies were connected to aircraft power in a way that was incompatible with the emergency electrical load-shedding design of the MD-11.

Documentation shows that initially, the intention was to power the IFEN system from the cabin buses. However, the cabin buses could not provide sufficient power for the full 257-seat configuration of the IFEN system that was originally planned. Therefore, 115 volts (V) alternating current (AC) Bus 2 was used to satisfy the majority of the IFEN power requirements.

Powering the IFEN from the 115 V AC Bus 2 would not have constituted a latent unsafe condition if the design had included a means of deactivating the IFEN system (e.g., by use of a switching relay) when the CABIN BUS switch was selected to the OFF position. An alternate method of complying with the MD-11 type certificate would have been to seek FAA approval of an FAA-approved Airplane Flight Manual supplement to provide the pilots with relevant instructions on how to deactivate the IFEN system during emergency procedures. However, neither of these alternatives was pursued, and the design flaw was not discovered until after the SR 111 occurrence. Therefore, pilots were not likely aware that the IFEN system would remain powered after the cabin bus was deactivated.

The design of the IFEN system-to-aircraft power integration constituted a latent unsafe condition. However, as the fire was underway at the time the CABIN BUS switch was used (13 minutes, 7 seconds, after the initial smell was noted), no link was established between this latent unsafe condition and the initiation or propagation of the fire.

2.14.2 FAA oversight (surveillance) of the IFEN STC project

In its capacity as a Designated Alteration Station (DAS), Santa Barbara Aerospace (SBA) was responsible for ensuring that the IFEN system complied with existing regulations, and that it was safely integrated into the aircraft design. As SBA was operating on behalf of the FAA, it was the responsibility of the FAA to ensure that SBA had the expertise to carry out its duties. At the time this Supplemental Type Certificate (STC) was being certified, the FAA procedures in place to oversee the delegation of authority to a DAS for STC certification did not ensure that anomalies could be identified and corrected.

As reflected in the electrical load analysis document used in the initial IFEN design and development work completed by Hollingsead International (HI), there was an intention to power the IFEN from the cabin bus. As the IFEN development work progressed, HI determined that there was insufficient electrical power available from the cabin bus, and changes were made to the drawings to take power from the 115 V AC Bus 2. It could not be determined how much of the preliminary design work by HI was shared with SBA. The Letter of Intent (LOI) that was submitted by SBA to the FAA reflected what appeared to be the initial intention for the installation. While an amendment would be expected with such significant changes, the LOI was not amended to reflect the design changes. Also, the FAA review process to accomplish the oversight function was unlikely to discover such anomalies, as it relied on being notified by the DAS of any change to the scope of the project.

2.14.3 IFEN system design and analysis requirements

Part of the certification process required that a safety analysis be carried out on the IFEN system in accordance with the provisions of FAR 25.1309. This analysis evaluates hazards associated with both the system's operation and failure modes. The level of effort to accomplish such an analysis ranges from a qualitative assessment, such as a functional hazard assessment based on experienced engineering judgment, to a complex quantitative assessment, such as a failure modes effects analysis, which includes a numerical probability analysis. The IFEN system's functional criticality, assigned by the STC applicant in its LOI to the FAA, was described as "non-essential, non-required."^{Footnote 119} Such a categorization would allow a qualitative analysis to be conducted based on prior engineering judgment and satisfactory past experience.

Based on the qualitative analysis done by SBA, the operational impact of this STC on cockpit workload and procedures was seen by SBA as minimal or non-existent throughout the IFEN project. As well, others involved in its design, certification, installation, testing, and operation presumed that the "non-essential, non-required" designation confirmed that whether failing or operating normally, the IFEN installation would have no adverse affect on aircraft cockpit operations. Consequently, the only testing that was completed on the IFEN installation was the electromagnetic interference/RF and system failure tests. Neither of these tests was required to determine whether the IFEN was powered in such a way that it degraded a critical emergency procedure, such as the one used to disconnect electrical services in the passenger cabin.

Use of the term "non-essential, non-required" likely created an environment in which normal cautions and defences that may have identified the design deficiency were reduced; however, there are also shortcomings in FAR 25.1309 that can allow critical design deficiencies to go undetected.

The provisions of FAR 25.1309 require that a system safety analysis be conducted in a manner that tests the impact of the operation of the system, during both normal operations and during failure modes. The initial step in this process is a functional criticality assessment, which tends to focus on the consequences of the failure of the system. When the outcome of a system's failure is deemed to be "minor," as in the case of most IFE installations, the system safety analysis is considered complete. However, assessing the consequences of the failure of a system as being either "minor" or "major," based only on whether it is capable of operating properly and failing benignly, does not confirm that it has been safely integrated into the aircraft.

Typically, detailed or quantitative integration analysis is reserved in FAR 25.1309, for those systems whose failure modes are deemed to have a "major" impact on safe flight and landing of the aircraft. This process serves to informally classify a given system as either "essential" or "non-essential"; therefore, the IFEN system installed in the Swissair MD-11s was designated as "non-essential, non-required." As an outcome, there was no minimum level of quantitative "integration" analysis required by FAR 25.1309, to ensure the system's compatibility with aircraft type-certified procedures, such as emergency load-shedding. Such an analysis would have established whether the system had been integrated in a manner compliant with the MD-11 type certificate.

2.14.4 FAA aircraft evaluation group role/STC involvement

The FAA Los Angeles Aircraft Certification Office was supported in their review of the IFEN STC by the FAA's Aircraft Evaluation Group (AEG) personnel, including Flight Standards Aviation Safety Inspectors who were experienced in air carrier operations, flight crew training, aircraft maintenance, and the aircraft certification process. These AEG personnel are responsible for conducting certification and operational suitability determinations for new and modified transport aircraft. Although the FAA delegates many of its responsibilities with respect to the STC certification process, it does not delegate the function of the AEG. Therefore, the DAS did not have a mandate to make determinations about STCs in areas of either operational or maintenance requirements.

In the case of STC ST00236LA-D, SBA submitted an LOI in which it concluded that there was no impact on the flight crew workload. The AEG reviewed the LOI and affirmed that conclusion. As only the AEG has the authority to make such a conclusion, the presence of such a statement in the LOI should have alerted the FAA that SBA had exceeded its DAS mandate. The fact that the IFEN installation was designated "non-essential, non-required" led to reduced vigilance and a de facto delegation of this AEG function.

An FAA survey of similar "non-essential, non-required" IFE system STCs revealed that approximately 10 per cent had been designed, installed, and certified in such a way that prevented the flight crew from removing electrical power from the entertainment system without interfering with essential systems. Although the extent of the AEG participation in the approval of these other STCs was not determined, the survey revealed that the incomplete nature of the operational review prior to the approval of STC ST00236LA-D, was not unique.

As the AEG function is not delegated, the FAA is responsible for determining operational and maintenance conformance of an STC. Therefore, the AEG has the responsibility to remain engaged in the process and work closely with the DAS to deliver an appropriate approval.

2.14.5 IFEN STC project management

Swissair's decision to acquire a state-of-the-art IFE system for its MD-11 fleet was a business decision. Historically, the airline relied on its MD-11 maintenance provider, SR Technics, to manage any modification work on its MD-11 aircraft. However, after SAir Group was restructured and SR Technics became a separate business entity, Swissair also had the option of acquiring modification services from contractors other than SR Technics. For the IFEN project, Swissair elected to enter into a contract with Interactive Flight Technologies (IFT) to provide all the necessary design, certification, and integration services required to install the system. Because this type of arrangement was not provided for in SR Technics' existing contract with Swissair, the airline entered into a separate agreement with SR Technics to furnish IFT with all necessary support to allow IFT to accomplish the MD-11 IFEN modification. Therefore, while Swissair regarded IFT as the overall IFEN project manager, it considered SR Technics as the sole agency responsible for the continuing airworthiness of its MD-11 fleet.

IFT met its contractual arrangements to Swissair by subcontracting significant portions of the IFEN project. Although subcontracting did not relieve IFT of its overall project management responsibilities, the subcontracting created a project management challenge because IFT did not have the expertise to verify the work of its subcontractors. This situation was compounded by the fact that IFT's prime subcontractor, HI, further subcontracted the delivery of the IFEN project certification services. Consequently, the critical portion of IFT's contractual responsibilities to Swissair became twice-removed from it, further complicating its ability to oversee the delivery of an FAA-approved STC.

Typically, a prime contractor would select a subcontractor based on the subcontractor's reputation, and on the fact that it is certified by the FAA or an equivalent government authority. The expectation exists that a certified company will be able to adequately perform the duties for which it is engaged, and that certified companies are subjected to an effective oversight program by the applicable government authority.

The FAA is the ultimate authority, and therefore is responsible for ensuring that an STC project does not compromise the type certificate of an aircraft certificated under its jurisdiction. In fulfilling this responsibility the FAA relies extensively on its DAS delegate system. The FAA holds the DAS accountable as the primary authority with respect to certification services on any STC project. At the same time, the FAA does not expect a DAS to conduct the same level of surveillance on companies performing STC work as would be required by the FAA in its certification of those companies. The FAA accepts that the DAS can expect that an FAA-certified company will be able to meet the minimum required FAA performance levels, even if that company is not required, by contract, to use its FAA certification directly in a given project.

The project management of the IFEN project did not follow the typical pattern used in the FAA delegation process. SBA was not in charge of the project and did not provide project management. Instead, SBA was contracted by HI, which the FAA would view as working under the authority of SBA. To a large extent, SBA relied on the reputation and FAA's certification of HI to ensure that the IFEN system was properly designed and integrated.

Along with HI and IFT, SBA also relied on SR Technics to provide a level of QA during each IFEN installation. SBA certified the IFEN system based on its assessment of the documentation provided by HI.

The overall result was that the IFEN STC project management structure did not ensure that all the required elements were in place to design, install, and certify a system that would be compatible with the MD-11 type certificate.

2.15  Factors influencing pilot decision making regarding initial odour and smoke

The data available regarding aircraft accidents involving in-flight fires illustrates the limited amount of time available to react to the first indications of a potential fire. In the case of SR 111, the pilots noticed an unusual odour in the cockpit at 0110:38, and 20 minutes, 40 seconds, later the aircraft struck the water.

The pilots were at a significant disadvantage when attempting to assess and react to the initial odour and smoke. They did not have detection devices that could have provided accurate information about the source of the odour and smoke. Nor did they have the capability to distinguish with certainty between odour and smoke from an air conditioning source, an electrical source, or a materials fire.

Initially, the pilots sensed only an abnormal smell (see Section 1.18.8.3). About 20 seconds later, at 0110:58, they observed a small amount of smoke entering the cockpit from behind and above them. The initial smoke quickly disappeared. More than two minutes later, they confirmed that smoke had reappeared, likely in the same area. Analysis of the information collected during the investigation indicates that the odour and smoke were migrating from a fire that likely started at the cockpit rear wall above the cockpit ceiling. Assessment of the airflow patterns in the cockpit would support the migration of some smoke from this area into the cockpit via a seam, or some holes, between the upper avionics CB panel and the overhead ceiling panel near the right overhead air diffuser. If the pilots interpreted that the smoke was entering through the overhead air diffuser, this would have contributed to their belief that the odour and smoke originated within the air conditioning system. As the fire initially migrated primarily aft into the area above the forward cabin drop-ceiling, the amount of smoke entering the cockpit would have likely been small and intermittent. The smoke would also have been significantly diluted by mixing with the diffuser air.

Based on the typical awareness level shown by other pilots during interviews, the SR 111 pilots would not likely have been aware of the presence of significant amounts of flammable material in the attic area of the aircraft. As a result, they would not have expected there to be a significant fire threat from that area, or from any other hidden area. There was nothing in their experience that would have caused them to consider the smoke to be associated with an ongoing uncontrolled fire consuming flammable material above the ceiling. Industry norms at the time of the SR 111 occurrence were such that other flight crews, if faced with the same scenario, would likely have interpreted the limited cues available in a similar way.

Based on historical data, it is generally accepted that smoke from an air conditioning system source does not pose an immediate threat to the safety of the aircraft or passengers, and that the threat can be mitigated through isolation procedures. Based on their assessment that the risk from the smoke was relatively low, it appears that the pilots saw no apparent reason to accept the additional risk of attempting an immediate emergency landing. Instead, they established priorities that included obtaining the information needed for the approach and preparing the aircraft for a safe landing. Initially, the amount of smoke entering the cockpit must have been low. Otherwise, it would be expected that they would have attempted to isolate the smoke origin by closing off the conditioned air sources. There is no indication on the aircraft's recorders that they completed any action item in the Air Conditioning Smoke checklist, although, the first action item on that checklist, which is selecting the ECON switch to the OFF position, is not a recorded parameter on the FDR. The first item on the Smoke/Fumes of Unknown Origin Checklist that was recorded on the CVR was carried out about 13 minutes after the odour first became apparent.

The pilots donned their oxygen masks approximately five minutes after they first detected the unusual odour (see Section 1.18.8.4). From what is known of their actions before they donned their oxygen masks, they were not affected by the smoke in any physical way, such as irritation to the eyes or respiratory tract. The materials that were burning would have emitted fumes that would contain noxious and potentially toxic combustion by-products. Exposure to these compounds in sufficient concentrations, particularly through inhalation, could affect performance and judgment.

See the supporting technical information on this topic.

2.16 Factors influencing pilot decision making during diversion

When the pilots started their descent toward Halifax at 0115:36, they had assessed that they were faced with an air conditioning smoke anomaly that did not require an emergency descent. Based on the perceived cues, they took steps to prepare the aircraft for an expedited descent, but not an emergency descent and landing.

The pilots were unfamiliar with the Halifax International Airport and did not have the approach charts readily available. The back-course instrument landing approach to Runway 06 was not pre-programmed into their flight management system (FMS). The pilots knew that they would have to take additional time to familiarize themselves with, and set up for, the approach and landing. They were given the weather information by the crew of an overflying aircraft, but did not know the runway lengths or orientation. Having the runway and instrument approach information available is normal practice and is important in carrying out a safe approach and landing, particularly at an unfamiliar airport at night.

In addition to these flight management circumstances, the pilots were aware that the meal service was underway, and that it would take some time to secure the cabin for a safe landing. Given the minimal threat from what they perceived to be air conditioning smoke, and the fact that there were no anomalies reported from the passenger cabin, they would likely have considered there to be a greater risk to the passengers and cabin crew if they were to conduct an emergency descent and landing without having prepared the cabin and positioned the aircraft for a stabilized approach and landing. It can be concluded that the pilots would have assessed the relative risks differently had they known that there was a fire in the aircraft.

The pilots also knew that the aircraft was too heavy for landing without exceeding the maximum overweight landing limits for non-emergency conditions. This would have been viewed as posing some risk, although it can be assumed that it would not have deterred them from continuing for an immediate landing, and dumping fuel during the landing approach, if they had perceived a significant threat to the aircraft. Coincident with their declaration of an emergency condition, the flight crew indicated that they were starting to dump fuel and there are indications that they did so.

2.17 Fire development

2.17.1 Potential ignition sources – General

There is no indication that the fire started outside the reconstructed fire-damaged area. The fire-damaged area contained numerous electrical wires and cables, along with light fixtures, an emergency lights battery pack, two electrically powered galleys, numerous module block electrical connectors, and electrically operated door mechanisms. Testing showed that MPET-covered insulation material can be readily ignited from an arcing event; however, MPET tended to shrink away from sources of high heat, such as might be generated by resistance heating at an under-torqued electrical power or ground wire connection. Various potential ignition sources, including electrical and non-electrical, were evaluated within the fire-damaged area. It was determined that the most likely ignition source was an electrical arcing event involving breached wire insulation that ignited nearby MPET-covered insulation material.

2.17.2 Arc-damaged cables and wires

Each of the arcs on the recovered 20 cable and wire segments was analyzed to determine whether it could have been the cause and origin of the fire, or whether the arc was created as a result of the fire. This process involved attempting to identify the system to which each of the arced cables and wires belonged and, where possible, its installed location in the aircraft.

Three arced wires were determined to be from particular aircraft systems, and the arc locations were accurately positioned in the aircraft. Had any of the three wires been involved in a lead arcing event, the pilots would most likely have noticed the associated loss of function, or the failure event would have been recorded on the FDR. There is no indication that either occurred.

There were nine arced wires for which no definitive location within the aircraft could be determined. For several of these nine arced wires, the arcing event could be reasonably linked to one of the known system-related failures captured on the FDR during the 92 seconds between the first recorded failure and the stoppage of the FDR recording. As these recorded failures occurred about 14 minutes after the initial detection of an unusual smell in the cockpit, these failures and associated arcs were determined not to be involved directly in the lead ignition event.

The remaining eight cable and wire segments with arcing damage were from the IFEN installation. The individual PSU cables and the control wire were assessed for possible involvement in the initial arcing event. Most of the arcing on the IFEN cables and wires could be attributed to fire-related damage; however, the arc located at 9 cm (3.5 inches) from the end of the Exhibit 1-3791 IFEN PSU cable segment could not be attributed to fire-related damage. Regardless of which conduit was used for the routing, with the cables and wires positioned as described in Section 1.14.11.2, this arc would have occurred just forward of manufacturing station (STA) 383, above the right rear cockpit ceiling just outside the forward end of the conduit.

2.17.3 Airflow, fire propagation, and potential ignition locations

The pre-fire airflow patterns were assessed to determine potential locations from which odour and smoke could enter the cockpit as noted by the pilots, and not be noticed in the passenger cabin. Each of these potential locations was then assessed to determine whether a fire originating at that location would match the known circumstances of the SR 111 fire. Factors that were considered included the presence of potential ignition sources and flammable materials; the likelihood that the fire could propagate from that area in the known time frame, given the amount of flammable material available; the likelihood that fire propagation from that area could result in the known sequence of aircraft systems anomalies; and the likelihood that a fire propagating from that area could produce the observed fire damage.

Of all of the potential locations analyzed, one area, on the right side close to the cut-out in the top of the cockpit rear wall just forward of STA 383 was found to match all the known circumstances involved in the fire. From this area, odour and smoke could migrate into the cockpit at a location where it could be interpreted as smoke coming from the air conditioning system via the right overhead diffuser outlet. Initially, smoke generated in this area would not likely be evident elsewhere in the aircraft. A fire could propagate rearward from the area near STA 383, and based on known material flammability characteristics and airflow patterns as described below, the fire could return with more intensity into the cockpit after a time delay. This succession of events could occur before the fire would affect the passenger cabin environment or aircraft systems.

A fire starting farther forward in the cockpit on the underside of the over-frame insulation blankets, ahead of the wires and wire bundles that cross laterally in front of STA 383, would likely have initially propagated over a larger area within the cockpit. If the fire were to start at a more forward location, fire-induced system malfunctions and failures would likely have occurred earlier and the associated symptoms would likely have been evident to the pilots early in the fire sequence and potentially been captured on the recorders. In addition, smoke would be expected to initially enter the cockpit from locations where the pilots would not likely have associated it with a conditioned air source. The cockpit ceiling liner would also be susceptible to early fire penetration and melting, inasmuch as the liner is fabricated from a thermoformable plastic that has a relatively low forming temperature.

Similarly, if the fire had started at a more inboard location on the underside of the over-frame insulation blankets, close to the aircraft centreline, the fire would be essentially bounded on both the left and right sides by wire runs that are routed in a fore and aft direction. These parallel wire runs enter the overhead switch panel housing through the oval holes on the aft side of the housing. The wire runs would be expected to act as fire barriers that would channel flame spread in a fore and aft corridor. As shown during flight tests, smoke would be expected to be drawn into the openings of the overhead panel housing and into the cockpit through passageways, such as the engine fire shut-off handle slots in the overhead panel. Again, smoke penetration into the cockpit through locations such as these would likely not be associated with having originated from conditioned air sources. The same reasoning would also apply to fires originating on the left side of the cockpit attic. These factors negate the plausibility of the fire originating elsewhere in the hidden areas of the cockpit.

2.17.4 Fire propagation from an arc fault near STA 38

2.17.4.1 General

A detailed assessment was conducted to determine whether the known conditions and subsequent events could be accounted for if the fire started just forward of the cut-out in the upper portion of the right cockpit rear wall near STA 383.

2.17.4.2 Initial fire propagation

An arcing event just forward of STA 383 near the front of the 102-cm (40-inch) long conduits, would have the potential to ignite MPET-covered insulation blankets. Ignition of MPET-covered insulation blankets at the STA 383 arc location would initially generate a small creeping flame that would produce a small amount of smoke, with a relatively strong accompanying odour. Most of the smoke and odour would initially be carried by the airflow being continuously drawn down the air space adjacent to the ladder assembly into the avionics compartment, from where it would be filtered and exhausted overboard.

The small flame would slowly propagate across the underside of the MPET-covered over-frame insulation blankets. It could not travel very far forward before being blocked or redirected by a series of wire bundles that contact the insulation blankets in this area. The fire would not likely travel up and across the underside of the over-frame insulation blankets against a prevailing airflow down the ladder. Also, there are some wires and wire bundles that are routed on the cockpit ceiling that would act as fire barriers. It is possible that the fire could propagate down the ladder with the prevailing airflow; however, the flame front would encounter a series of horizontal wire support brackets that would act as fire barriers. Although it is possible that the fire could migrate around obstructions such as these, no physical evidence was found to indicate that the fire had propagated into the avionics compartment, because other than soot, there was no fire damage in that area.

2.17.4.3 Initial odour and smoke in the cockpit

If the flame front was able to propagate a relatively small distance inboard before predominantly propagating aft, it is likely that odour or smoke generated near STA 383 would momentarily be drawn into the cockpit through the holes and air gaps near the top of the avionics CB panel. Even if the flame front did not propagate sufficiently inboard for this to occur, it is likely that odour and smoke would enter the cockpit through these locations during the early stages of the fire. This would be expected to take place soon after the fire ignited the MPET-covered muff assembly adjacent to the smoke barrier or the insulation blanket on the riser duct assembly. In testing, smoke released over the front surface of the upper avionics CB panel near the rear right cockpit wall was initially blown downward before swirling back upward, eventually following a corkscrew path forward toward the flight crew seats.

The smoke would have to travel a relatively turbulent path before reaching the pilots. It would become more diffused, and it is likely that the smoke would initially present a weak visual indication. Therefore, the pilots would most likely detect an odour before seeing smoke. The most likely area where smoke would eventually be visible, would be in the vicinity of the avionics CB panel near the rear right cockpit wall. The density of the smoke would be greatest where it first enters the cockpit. The right overhead diffuser would accelerate the motion of the smoke, making it easier to detect. The smoke would also be in proximity to the overhead dome light, which would enhance the detection of airborne smoke particulates.

2.17.4.4 Fire propagation aft – Out of the cockpit

A small flame front could travel aft from the initiating location and pass over the cockpit rear wall through the cut-out. If present, the foam material used around the conduits and wire runs at the cockpit cut-out would either melt, or ignite and create additional smoke and odour.

When the small flame front passed over the cockpit rear wall, it is likely that for a short time the smoke was no longer migrating into the cockpit in sufficient quantity to be visible. Most of the smoke and odour would be expected to be exhausted down the ladder area during this interval. This condition would change once the fire ignited the MPET-covered muff assembly adjacent to the smoke barrier, or the insulation blanket on the riser duct assembly. Ignition of this insulation blanket would create additional smoke and odour that would ultimately be directed to areas near the smoke barrier. Airflow tests show that smoke and odour present in these areas could also migrate into the cockpit through openings in the smoke barrier.

Soon after the MPET-covered muff assembly was ignited, it is likely that a small propagating flame front breached, to some extent, the exposed Galley 2 silicone elastomeric vent cap. This vent cap is located immediately adjacent to the forward end of the muff assembly, next to the cockpit rear wall, adjacent to the smoke barrier. Air would immediately be drawn through the breached opening into the galley vent duct assembly, as soon as the vent cap was penetrated. This airflow would likely extinguish the small propagating flame front on the muff assembly in the area immediately adjacent to this vent cap. In testing of MPET-covered insulation blankets, air currents typically extinguished small propagating flame fronts.

It is also likely that the burning silicone elastomeric end cap would be extinguished at the same time owing to the sudden and continuous draw of air through the spot where initial fire penetration took place. Flame propagation along MPET-covered insulation blankets could still be taking place elsewhere, since by the time the Galley 2 vent cap was ignited, flame propagation would have likely spread over a much larger area including onto the riser duct assembly. The draw of air through the vent cap would also be expected to be small, causing only a localized air current effect. Once the fire intensified in the riser duct area and propagated onto the right fuselage side wall, the vent cap likely would have reignited or melted, resulting in the complete failure of the vent cap. This would create a much larger opening and a much larger draw of air into the vent duct system. The early draw of air and combustion by-products into the vent duct system could delay the return of smoke and odour into the cockpit, and delay the early detection of the fire in the passenger cabin.

The vertical air spaces adjacent to the centre riser duct, and between the aft side of the aft riser duct and the forward side of the R1 door frame, would channel hot combustion by-products, and create a chimney plume effect that would produce concentrated heat in areas above these air spaces. This plume effect would be further promoted by the vertical walled-in confinement of the MPET-insulated lower section of the riser duct assembly. Evidence of a high-temperature chimney plume effect was apparent in the wreckage that corresponded to these locations.

The eventual complete fire-related failure of the Galley 2 vent cap would cause a large volume of air to be drawn into the galley vent system at that location and would significantly change airflow patterns. A high-temperature fire damage pattern was found on ducts adjacent to the vent cap location. Overall damage patterns in the area are consistent with hot combustion by-products being drawn past the waterfall area, then forward underneath the riser ducts toward and into the galley vent duct system. The flow of hot combustion by-products, between the underside of the aft riser duct and the CD 207 ceiling panel below it, would create a significant localized convective heat effect on the panel. High-temperature fire damage of this nature was found on a piece of a CD 207 panel. This piece of panel most likely came from the sliding ceiling panel used at the R1 door location. Heat on this piece was consistent with a temperature exposure of 593°C (1 100°F) for a duration of 10 minutes.

2.17.4.5 Fire affecting IFEN PSU cables above galley 2

The lower portions of the fuselage frames at STA 401 and STA 410, between plane 15 right and plane 15 left, exhibited high-temperature damage. In addition, localized high-temperature damage was also found on some polyimide-insulated wires in the FDC wire run, concentrated between STA 401 and STA 410. This wire run is routed adjacent to the middle conduit on the ceiling above Galley 2. These heat damage patterns are consistent with localized high-temperature chimney plume effects created by the presence of a vertical air space on each side of the centre riser duct along its outboard face. The tops of the two chimney plumes intersect the ceiling at STA 401 and STA 410.

When the IFEN control wire and PSU cables are positioned to simulate the outboard conduit, the cable layout matches the overall damage pattern in the assembly, with five wire arc locations aligning at approximately STA 401. This is consistent with the fluorinated ethylene-propylene conduit and ethylene-tetrafluoroethylene (ETFE) wire insulation being preferentially melted through at this location, causing multiple wire-to-wire arcing events. These events would likely trip the associated CBs and sever the wires at some arc locations, opening the electrical circuit and de-energizing these power cables.

2.17.4.6 Fire affecting IFEN PSU cable outside aft end of conduit

Concentrated high heat damage was found directly above the R1 door, flapper door ramp deflector and above the adjacent wire bundles in the waterfall area. This damage was manifested in the form of broomstraw-like features on a localized region of the R1 forward door track that is attached to the bottom of the fuselage frames. On such a robust part, high heat is required over a relatively long time to create damage of this type. The high heat damage at this location is consistent with a chimney plume effect that channelled hot combustion by-products upward and impinged on the ceiling. The location of the broomstraw-like heat damage corresponds to the area above the inside radius of the elbow connection for the riser duct assembly. This geometry, together with other factors, such as the alignment of a vertical air space between the aft side of the aft riser duct and the cabin interior wall panel, favoured the formation of a plume as the MPET-covered insulation blanket combusted on the riser duct assembly. Further corroboration of such an event having taken place was the presence of other broomstraw-like features immediately adjacent to the same location, on the lower portions of an intercostal between STA 427 and STA 435, and nearby along the lower portions of a frame at STA 442 between plane 15 right and plane 15 left. Additional localized heating in the waterfall area would occur as hot combustion by-products were drawn under the riser ducts to the Galley 2 vent duct.

This localized heating would account for the missing tin coating on the three recovered IFEN PSU cables between STA 420 and STA 427, just aft of where they exited the conduit. At this location, the Exhibit 1-3790 PSU cable had arcs on each of its three phases. This same cable had also arced further forward within the conduit. The two separate arc locations on this cable are consistent with the fire propagating in the fore-to-aft direction, first causing an arc to take place at the forward position, not tripping the CB, then subsequently causing a second arc near the waterfall area that tripped the CB. The absence of arcs on the other two recovered PSU cables from the waterfall location, specifically in the area where the tin coating was missing from these cables, is consistent with these two cables being de-energized when the arc occurred on Exhibit 1-3790 at the waterfall location. This latter observation is also consistent with the two other PSU cables being previously de-energized by the tripping of their respective CBs when the multiple arcing events took place in the conduit. The latter further supports a fore-to-aft direction of fire propagation.

2.17.4.7 Fire progression – Riser duct area to the left side of the fuselage and aft

The burning of relatively large quantities of MPET insulation blanket cover material in the vicinity of the riser duct assembly would create a significant heat release. Although some of the combustion by-products would continue to be drawn down the ladder area and into the breached Galley 2 vent duct system, most of the by-products would flow upward in hot buoyant plumes. These by-products would form a hot buoyant layer along the upper attic air space above the forward cabin drop-ceiling.

The smoke barrier assembly would initially prevent most of the hot combustion by-products from flowing forward into the cockpit attic air space. Some leakage would be expected to take place, which would allow some by-products to penetrate into the flight crew compartment. Combustion by-products would also be drawn down the engine fire shut-off cable drop, where smoke could also leak into the cockpit interior. An indication of that flow having taken place was the presence of soot on some of the interior surfaces of the recovered cable drop shroud pieces.

The hot combustion by-products would heat the ceiling insulation and other items, including those below the hot buoyant layer, by processes such as radiant heating. Preheating and subsequent ignition of other materials would take place, including the ignition of the metallized polyvinyl fluoride (MPVF) insulation blanket cover material and splicing tape on the ducts. This in turn would be expected to cause ignition of the silicone elastomeric end cap situated on the end of the conditioned air branch duct, located approximately 30 cm (12 inches) aft of the cockpit door, above the ceiling panels. Failure of the end cap would cause a continuous release of conditioned air, which would further exacerbate the fire. An indication that this end cap had been breached by the fire was the presence of high heat damage on recovered portions of the branch duct where the cap was situated.

Release of conditioned air out of the branch duct would be directed slightly upward and laterally across the aircraft, toward the Galley 1 vent duct plenum, situated approximately 46 cm (18 inches) away from the end cap. This forced air ventilation would be expected to not only deliver conditioned air, but also entrain hot combustion by-products with it. A hot airflow (convective oven effect) would likely be created in certain areas along flow lines. Owing to the geometry of the ducts in the area, the flow would be channelled along a tapered path toward, and over, the top of the exposed portion of Galley 1. Indications that a hot airflow existed in this area were the broomstraw-like features that were present on the lower surfaces of intercostals and frames in the vicinity, and heat damage to the top of Galley 1. There was also high heat damage concentrated on the inboard side of the intercostals, which face the branch duct.

It is likely that the fire-induced failure of the branch duct silicone elastomeric end cap preceded and contributed to the failure of at least one, if not both, of the Galley 1 vent duct hose connections. The hoses were constructed from a fibreglass cloth, which was impregnated with a red-coloured silicone-like rubber material. Failure of the hose connection or connections would draw air and combustion by-products into the vent duct assembly. This exhaust ventilation would further exacerbate the fire. Indications that hose failure had taken place at some point during the fire was indicated by the abrupt cessation of heat damage along the top outboard face of Galley 1 at an elevation that corresponded to one of the hose connections, and by the presence of high-temperature heat damage on pieces of vent duct assembly just outboard of Galley 1.

The presence of high heat in the attic air spaces would likely cause the nylon fasteners holding the MPET-covered over-frame and between-frame insulation blankets to melt and fail. This would allow portions of the insulation blankets, or whole insulation blanket assemblies, to fall free, exposing more flammable MPET cover material to the fire. This in turn would significantly add to the growth and intensity of the fire.

The hot buoyant layer above the forward cabin drop-ceiling would be free to flow aft toward the empennage of the aircraft above the passenger cabin ceiling. Some of these by-products would continue to be drawn into the recirculation fan intakes, while these systems were operating. After passing through the intakes, the by-products would be delivered to areas within the passenger cabin. Soot patterns found on items such as wire support brackets, and on and within an overhead stowage bin located at STA 1780, indicate that the attic space above the passenger cabin probably became filled with combustion by-products. No smoke was reported in the passenger cabin prior to the flight recorders stopping.

2.17.4.8 Progression of the fire into the cockpit

Before the pilots selected the CABIN BUS switch to the OFF position at 0123:45, the airflow above the forward cabin drop-ceiling would have predominantly been in an aft direction, toward the input of the recirculation fans. Some smoke and combustion by-products would have been migrating into the cockpit. Several soot deposits were found in various places to indicate such seepage. At about this time, it is likely that the fire breached the silicone elastomeric end cap on a short branch stub on an air conditioning duct located immediately aft and overhead of the cockpit door. This would have allowed a large volume of conditioned air to enter the area and augment the fire. This additional airflow would have rapidly accelerated the propagation of the fire, as indicated by the high heat damage observed on the surrounding ducts and aircraft structure.

Selecting the CABIN BUS switch to the OFF position would shut down the recirculation fans, and result in a reversal of the airflow above the forward cabin drop-ceiling. With the airflow then moving predominantly forward, hot combustion by-products would have been drawn toward the cockpit attic air space.

It is likely that the weakened smoke barrier would have completely failed shortly after the CABIN BUS switch was selected to the OFF position. Although it is possible that the smoke barrier could have failed earlier, this is considered unlikely, because such a failure would have likely led to an earlier failure of the thermoformable plastic cockpit ceiling liner, which melts within a relatively low temperature range. Following the breach of the smoke barrier, hot combustion by-products could then freely fill the cockpit attic air space. The fill rate would likely exceed the exhaust rate, and a significant rapid build-up of heat and combustion by-products would occur. Hot combustion by-products would penetrate, fill, and rapidly heat the air spaces behind the avionics CB panel, overhead CB panel, and overhead panel housing. The MPET- and MPVF-covered insulation blankets above the cockpit ceiling would provide additional combustible material to the fire. This would further contribute to the amount of smoke entering the cockpit through passageways, such as the engine fire shut-off handle slots, and the various cut-outs in the cockpit ceiling liner.

The rapid heating of the air spaces and electrical components behind the CB panels, and within other assemblies, would have caused aircraft systems to malfunction. The heat would have thermally tripped some CBs that would likely have resulted in many of the anomalies that were subsequently recorded. For example, the Autopilot 2 disconnect event took place approximately 20 seconds after the CABIN BUS switch was selected to the OFF position; this was followed shortly thereafter by a series of recorded system anomalies.

The right side of the cockpit ceiling primarily consists of several aluminum panels that would act, in combination with other metallic assemblies such as the conditioned air diffusers, as a physical barrier to the fire and its combustion by-products. In contrast, the cockpit ceiling on the left side consists mainly of liner material that would soften, sag, and melt when exposed to high temperatures.

As the fire entered the cockpit attic area, the heat would have first affected the most exposed surfaces of the ceiling liner just forward of the cockpit door, in the area aft of the diffuser, and in the left overhead region. Very little liner material from these areas was identified in the wreckage. The few pieces that were identified, such as a portion of the cockpit spare-lamps cover and hinge (located in the ceiling adjacent to the cockpit coat closet), showed signs of melting. Some of the liner material may have been consumed by the fire. Pieces of the liner from other areas appear blackened and burned along some edges. Other pieces were also melted, and some had flowed until their cross-sectional area was reduced to the thinness of paper.

Based on the high temperatures involved, it is likely that the breach of the ceiling liner occurred approximately one minute after the smoke barrier failed. The breach of the ceiling liner may have corresponded to the time the pilots declared the emergency at 0124:42. Most of the fire damage on the cockpit carpet was likely the result of portions of the melted ceiling liner dropping on it. Larger amounts of dense noxious smoke and hot combustion by-products would be expected to have immediately penetrated through openings in the cockpit ceiling liner.

Once the cockpit liner had been breached, the openings in the liner would be expected to progressively expand, allowing a further increase in the volume of dense noxious smoke and combustion by-products into the cockpit. The smoke would be drawn down through the openings next to the rudder pedals into the avionics compartment. Visibility within the cockpit would be expected to become progressively worse.

It is likely that the fire would have breached the silicone elastomeric end cap situated on the end of a conditioned air branch duct, located above the lower assembly of the left overhead cockpit ceiling liner, just forward of the cockpit coat closet. The insulation cover splicing tape installed over the MPVF-covered muff assembly, which fixes the muff assembly in place over the end cap, would provide a source of combustible material. Once the tape was ignited, the integrity of the muff assembly would be lost and ignition of the silicone end cap would likely soon ensue. Heat damage and melting were found on the edges of the recovered liner at a location immediately adjacent to the end cap's position. Failure of the end cap would cause conditioned air to be continuously blown out the branch duct above the ceiling liner, in close proximity to the MPET-covered over-frame and between-frame insulation blankets, exacerbating the fire situation. It is likely that the hose to the individual air outlet near the centre of the left overhead cockpit ceiling liner was also breached, causing a similar effect.

Portions of a fuselage frame and conditioned air duct assembly near the hose and hose connection exhibited high-temperature damage. Cone calorimeter^{Footnote 120} tests indicate that material similar to the hose in question ignites at a heat flux of 25 kW/m2 (which is approximately equivalent to a surface equilibrium temperature of 591°C (1 095°F)), and it is probable that the hose would not withstand exposure to such high temperatures. The same would also apply to the hose for the other individual air outlet located further forward in the liner, to the left of the overhead CB panel. Similar high-temperature fuselage frame damage was found nearby. Failure of the silicone elastomeric end cap and the individual air outlet hoses would introduce conditioned air to the fire, which would likely contribute to the deteriorating environment within the cockpit.

As the MPET cover material was consumed by the fire, the underlying fibreglass batting in the insulation blankets would become exposed and then badly scorched by the high temperatures and flames. The forcible release of conditioned air in close proximity to the insulation blankets would likely disturb and release fibreglass particulates from the ashen surfaces and from the less-damaged areas underneath these surfaces where the adhesive binder would be degraded.

After the completion of burn tests, the release of clouds of small particulates was observed to take place whenever the burnt insulation blankets were disturbed or removed from the test fixtures.

The captain's location would have been more directly in line with the area of the cockpit ceiling liner that was first breached. A higher percentage of the combustion by-products would be expected to flow directly toward the captain's seat location, and be drawn down into the avionics compartment through the captain's rudder pedal openings. The situation in the cockpit would have continued to deteriorate as systems malfunctioned and failed, owing to the effects of the fire.

Eventually, molten aluminum began to drip in the area of the right observer's seat, as indicated by the presence of resolidified aluminum deposits that were found on the recovered pieces of the seat. A 2024 aluminum alloy deposit was found on a screw on the right side of the seat pedestal, as well as on the right lap belt. There were also remnants of other aluminum deposits immediately adjacent to the 2024 aluminum alloy deposit on the belt. The type of alloy or alloys on these remnants could not be determined, as there was insufficient material available for analysis. Also, a 6061 aluminum alloy deposit was found on the CB for the seat, which is located near the rear right corner of the seat pedestal.

The sources of the aluminum deposits could not be conclusively determined; however, the possible areas from which 2024 aluminum alloy deposits could fall onto the right observer's seat are limited. Assuming that the integrity of the overhead dome light and the 6061 aluminum alloy diffuser assemblies were not compromised during the fire, the only major opening that could be created in the ceiling directly above the right observer's seat would be along a narrow rectangular-shaped area that predominantly comprises ceiling liner material. This area is approximately 7.5 cm (3 inches) in width by 76 cm (30 inches) in length. High heat damage is evident on portions of the recovered pieces of the diffuser assemblies and fuselage frames from above this location. Most of the upper edge of the recovered pieces of the avionics CB panel also exhibited high heat damage.

One known potential source of 2024 aluminum alloy is the AN 929-6 cap assembly, which is located on the crew oxygen supply line at STA 374. The end cap is situated above, and immediately adjacent to (within about 2.5 cm (1 inch)) the narrow rectangular-shaped area described above. This oxygen line cap assembly is in close vertical alignment with the right edge of the right observer's seat, near the right lap belt location and near the right side of the seat pedestal, when the seat is in the forward-facing position with the armrests stowed upright. Indications of broomstraw-like features were found along the bottom edges of the fuselage frame at STA 374 just above, and adjacent to, the cap. This further indicated that high temperatures had existed at this location.

Testing on the oxygen cap assembly indicated that before leakage or failure of the cap occurred, it would have to be heated at elevated temperatures for several minutes (see Section 1.14.13). These elevated temperatures were below the temperature at which external melting was visible on the cap. Therefore, if the time at which the CABIN BUS switch was selected to the OFF position is used as a reference for when significant elevated heating took place in the cockpit attic air space (approximately 8 minutes, 30 seconds, prior to the time of impact), the most likely time frame that melting of the cap could take place would correspond to the final stages of the flight.

If pure oxygen leaked from the cap during the fire, there would almost certainly be a quick and dramatic increase in the fire intensity. This would be expected to rapidly lead to a complete failure of the cap. A complete failure of the cap would result in a loss of pressure in the line and would abruptly stop the flow of oxygen to both pilots' oxygen masks. In addition, full venting of the line would be expected to quickly lead to a flashover within the cockpit, or an intense conflagration, or both. There was little physical evidence of an overall high-temperature damage pattern in the cockpit interior; therefore, it is likely that if this occurred, it was of a very short duration, and it occurred immediately prior to the time of impact.

2.18 Known technical failure events

The first indication to the pilots of a systems-related failure was the disconnect of the autopilot at 0124:09 (see Section 1.18.8.6). Twenty-four seconds prior to this, at 0123:45, the captain had selected the CABIN BUS switch to the OFF position. This selection is the first action item in the Swissair Smoke/Fumes of Unknown Origin Checklist. Until that point, it appears that the conditions in the cockpit were such that the pilots perceived that they were dealing with smoke from an air conditioning source.

The airflow testing showed that with the recirculation fans off, as would be the case after the CABIN BUS switch was selected to the OFF position, the predominant airflow in the forward attic area reverses direction so that instead of flowing aft toward the fans, much of the air flows forward into the cockpit attic area, and then down through the cockpit into the avionics compartment below the cockpit.

Between the time the captain selected the CABIN BUS switch to the OFF position at 0123:45 and when the flight recorders stopped recording at 0125:41, the fire-related effects in the cockpit began. This is confirmed by the rapid succession of systems-related failures. The environmental conditions in the cockpit also began to deteriorate rapidly, with an increasing amount of smoke, heat, and fire entering from overhead.

The systems failures up to that point, would have reduced the ability of the pilots to control and navigate the aircraft, especially at night, with smoke in the cockpit, and in instrument meteorological conditions. The loss of the autopilot would have added to the pilots' workload, and the associated warbler warning tone that sounded until the end of the CVR recording would have been disconcerting. The master caution light would have illuminated with the loss of flight control computer 1, Channel A at 0124:57; it is unknown whether the pilots reset the master caution light. The loss of the left emergency AC bus at 0125:06 would, in part, have caused the loss of the captain's display units (DU) 1 and 3. DU 2 would show a red X, and the master caution light would illuminate. Again, it is unknown whether the pilots reset this caution light; however, if they did, the loss of the captain's pitot heat, about 10 seconds later, would have triggered the master caution light again. These failures would have been accompanied by numerous fault messages, cues, and alerts. Dealing with such a barrage of faults and messages would have been confusing, distracting, and difficult to cope with.

The loss of all three of the first officer's DUs at about 0125:30 would have forced him to use the standby instruments to maintain aircraft spatial orientation (see Section 1.18.8.21). The transition to the standby instruments would have been challenging because of their small size and positioning, relative to each other, especially in the deteriorating conditions (increasing smoke and heat) of the cockpit.

At that point, although the captain may have restored all primary flight display information, (such as aircraft attitude, airspeed, heading, and altitude) on DU 2, DUs 1 and 3 had failed and it would have been impossible to restore these two displays. Although all three 115 V AC generator buses were functional at the time of impact, fire damage to distribution buses, wires and cables, and CBs disrupted the electrical power to some, or all (if DU 2 was lost) of the systems that provided primary attitude information, navigation, communications, and various other functions. Consequently, the pilots would have been dealing with a multiplicity of tasks, many of which were highly abnormal, while the cockpit environment was rapidly deteriorating.

2.19 Remaining few minutes following stoppage of recorders

The final 5 minutes and 37 seconds of the flight, from when the flight recorders stopped at 0125:41, were not recorded on the FDR or the CVR. To the extent possible, the events that occurred were reconstructed using information from ground-based primary radar data, full-authority digital electronic control non-volatile memory data, air traffic control (ATC) recordings, witness statements, and wreckage examination.

An analysis of the heat damage observed on the reconstructed cockpit wreckage, together with the likely fire propagation scenario, shows that the fire increased in intensity during the final six minutes of the flight. The amount of smoke, heat, and fire entering the cockpit would have continued to increase.

There are indications that at 0125:50, about eight seconds after the flight recorders stopped, the pilots switched the air data source to air data computer (ADC)-2 from ADC-1 (see Section 1.18.8.26). This was most likely done in an attempt to recover some lost flight instrumentation. The wire examination shows that the left emergency AC bus, which powered ADC-1, experienced an arcing event. The arcing would have caused it to become de-powered, resulting in the loss of ADC-1. When the pilots selected ADC-2, it temporarily restored the transponder Mode C altitude information, which showed the aircraft to be at 9 700 feet. At 0126:04, transponder information stopped being transmitted from the aircraft for the remainder of the flight. ATC radar equipment continued to record the aircraft track on primary radar until it disappeared from the radar screen about 10 seconds before the aircraft's impact with the water.

In their second-last transmission to ATC at 0124:53, the pilots reported that they were starting to dump fuel. There are some indications from witness information that they initiated fuel dumping after the recorders stopped. Also, the auxiliary tank isolation valve was found closed, which would be expected if fuel dumping had commenced. The fuel dump valves were closed at the time of impact, indicating that the fuel dumping had been stopped by the pilots.

Before the recorders stopped, the pilots indicated that they needed to land the aircraft without delay. Despite this, the aircraft continued on its southbound track away from the airport and out toward the ocean. This suggests that the condition in the cockpit quickly deteriorated to a point where the pilots were unable to effectively navigate the aircraft. They would likely have lost most of their electronic navigation capability, and the increasing amount of smoke entering the cockpit would have made it progressively difficult to see out the windscreens to navigate visually, especially in unfamiliar territory at night and with cloud layers in the vicinity.

The aircraft continued to descend in a right turn as it passed over the community of Blandford, Nova Scotia. Witnesses on the ground described hearing a noise having a repetitive beat frequency and that was generated at a constant rate and superimposed on the loud engine sound. Engine 2 was being shut down at about this time; however, no explanation for this "repetitive beat" noise could be established. People also described seeing various aircraft lights, indicating that at least some of the aircraft electrical systems were still powered. This was confirmed by the examination of various systems such as fuel pumps and fans, whose rotating components showed signs of being powered at the time of impact. Examination of components indicated that all three generator buses were being powered at the time of impact.

Shortly after passing the Nova Scotia coastline, the aircraft started a right turn. Although indications are that the captain's clearview window was likely unlocked, it is unknown when or whether the window was ever opened. At some point, the pilots selected the flaps to the pre-selected 15-degree DIAL-A-FLAP setting. When they shut down Engine 2 at about 1 800 feet, approximately one minute before the time of impact, the airspeed was about 227 knots true airspeed. The average rate of descent just prior to this time was estimated to be about 2 000 feet per minute.

The reason for the Engine 2 shutdown prior to the time of impact is unknown. One possible explanation is that the crew received a false fire warning indication. A short-circuiting of the ground wire in the Firex Handle 2 could cause both the Firex Handle 2 lights and Engine 2 fuel switch light to come on. The ground wire was not identified; however, the ground wire was installed in an area of high heat and fire damage. One of the cockpit emergency checklist booklets was found to have some minor heat distress on the page describing the "ENGINE - FIRE" procedure; however, it is unknown whether the checklist was being used during the engine shutdown. Closing the FUEL switch is part of this checklist procedure.

The passenger cabin environment would have been significantly less hostile than the cockpit environment. Although soot was noted in the attic area aft of the main fire area, there were no signs of appreciable heat in the attic aft of the first-class seats. The ceiling panels used in the passenger cabin have a significant resistance to fire and heat penetration and would have protected the passenger cabin from the effects of the fire. Some smoke would probably have been entering the passenger cabin during the last few minutes of the flight, especially at the front of the cabin.

It is unknown whether any firefighting took place using the available fire extinguishers. Based on examination, it was determined that neither of the two portable 5 lb dry chemical extinguishers mounted in the cabin were likely used. Three of the six 2.5 lb Halon portable extinguishers were not likely used; however, the charge state of the three remaining Halon extinguishers could not be determined because of the physical damage to the extinguishers. If firefighting took place, it would be expected that the M/C would have been involved; the M/C was seated at the time of impact with his seat belt fastened.

One of the passengers, who was a pilot, was wearing a life vest at the time of impact. There were no other indications that anyone else had donned a life vest, although no definitive conclusions were possible in most cases. It is unknown whether this passenger had donned his life vest by instruction or through his own initiative. If he had donned the life vest on his own, he must have been able to discern or surmise that the aircraft was over water and was in danger of ditching. If it was a result of a crew instruction, then there must have been a plan to ditch the aircraft. It would then be expected that the M/C would have been wearing his life vest, which he was not; this suggests there was no instruction to prepare for ditching.

In the last minutes, other than possibly having an electronically generated heading on DU 2, the pilots would have had no electronic means of navigating to the airport, and would have been forced to consider alternatives, such as attempting a crash landing on land or ditching into the ocean. From the wreckage examination, it is known that the fire in the cockpit created heat damage signatures of 482°C to 538°C (900°F to 1 000°F) on the forward portion of the avionics CB panel and on the air diffuser structure just above the cockpit ceiling. There was evidence that melted material had dropped down on the carpet and on the right observer's seat cover. The fire was encroaching on the pilot seat positions from the rear of the cockpit. The heavy soot deposits, and the heat-damaged condition of some of the cockpit materials, indicate that visibility would have been significantly obscured within the cockpit. It could not be determined whether the cockpit fire extinguisher had been used.

The first officer's seat was occupied at the time of impact; the captain's seat was in the egress position. Although the standby attitude display showed the aircraft to be at 20 degrees nose down, and 110 degrees right bank at the time of impact, it could not be determined whether these indications represented the actual aircraft attitude at the time of impact. The structural damage supports a nose-down attitude of about 20 degrees, and a right bank in excess of 60 degrees. If the pilots were not incapacitated and were still attempting to control the aircraft, this suggests that in the last minute of the flight they lost orientation with the horizon. This would not be unexpected, given the lack of reference instrumentation, and lack of visual cues from outside the aircraft. Regardless of whether there was pilot input at the time of impact, the aircraft was not in controlled flight.

2.20 Actual versus theoretical emergency descent profile

2.20.1 General

This section examines the actual flight profile of SR 111 and the optimal theoretical emergency descent profile. The theoretical calculations were undertaken solely to provide an academic reference baseline, and did not take into account any of the cues upon which the SR 111 crew decisions were based. Also not taken into account were the actual adverse factors that would have had a significant negative effect on the ability of the pilots to maintain an optimal descent profile and to land the aircraft.

See the supporting technical information on this topic.

2.20.2 Earliest possible landing time

Theoretical calculations show that if an emergency descent had been started from the optimum starting point at 0114:18, the earliest possible landing time would have been 0127. This landing time would only have been possible if there had been no technical malfunctions or adverse cockpit environmental conditions inhibiting the ability of the pilots to navigate and configure the aircraft to obtain its optimum performance capabilities. Any deviation from these "ideal" conditions would result in a later landing time because either the aircraft would require extra manoeuvring off the direct track to the airport, or the aircraft would reach the airport with too much altitude or airspeed to land.

2.20.3 Effect of fire-related failures on landing

At 0124:09, nearly three minutes before the earliest possible landing time, the aircraft had started to experience an increasingly rapid succession of systems-related failures. The pilots declared an emergency at 0124:42, slightly more than two minutes before the theoretical earliest possible landing time. Several additional systems-related failures, including the loss of the first officer's DUs and communications with ATS, occurred one minute later (0125:42), just prior to the stoppage of the flight recorders.

By the time the recorders stopped, the cockpit environment was rapidly deteriorating. The fire was invading the cockpit from the overhead ceiling area. Just before the recorders stopped, the pilots indicated that they needed to land immediately; however, they apparently lost their ability to navigate, as they did not steer the aircraft toward the airport. At some point within the last five minutes, the aircraft's slats became unserviceable. Based on heat damage to wires and associated CBs, it is also possible that the auto ground spoilers, auto-brakes, and anti-skid braking system would have become inoperative before the aircraft could have landed. Under such conditions, it would have been impossible to stop the aircraft on the available runway even if it could have landed.

Based on these factors, it is evident that even if the pilots had attempted a minimum-time emergency diversion starting at 0114:18, it would have been impossible for the pilots to continue maintaining control of the aircraft for the amount of time necessary to reach the airport and complete a safe landing.

2.20.4 Theoretical emergency descent calculations

By coincidence, the time at which an emergency descent would have needed to begin to achieve the optimum theoretical emergency descent profile to land at the Halifax International Airport coincided with the actual time of the Pan Pan radio transmission. Any delay in descending would mean that the aircraft would be above the ideal descent profile. During the Pan Pan transmission, the captain requested a diversion and suggested Boston. It was not until about 1 minute and 25 seconds later that the following events were completed: the controller offered Halifax as an alternative diversion airport, the pilots evaluated and accepted Halifax, and the pilots commenced a non-emergency but rapid descent.

During that time, the aircraft was travelling in the general direction of the Halifax International Airport at a ground speed of more than 8 nautical miles (nm) per minute. From the actual descent start point, it would not have been possible for the pilots to position the aircraft for a landing on Runway 06, without some form of off-track manoeuvre to lose altitude and slow to the appropriate speed. In a best-case scenario, the extra manoeuvring would have added two or three minutes to the landing time. More likely, a manoeuvre such as a 360-degree turn would have been necessary, or they would have had to switch to a different runway. Either choice would have added several minutes to the earliest possible landing time, and the effects of the fire would have negated the possibility of completing a safe landing.

At about 0125, when the fire condition became distinctly evident in the cockpit, the aircraft was about 25 nm from the airport, at an altitude of about 10 000 feet, and at an airspeed of about 320 knots. It was flying in a southerly direction, away from the airport. In optimum circumstances, from that point it would have taken a minimum of about six minutes to get to the runway.

Theoretical calculations confirm that from any point along the actual flight path after the aircraft started to descend, it would not have been possible for the pilots to continue maintaining control of the aircraft for the amount of time necessary to reach the airport and complete a landing.

2.21 Fire initiation

An evaluation of the available information indicates that the fire likely started within the confines of a relatively small area above the right rear cockpit ceiling just forward of the cockpit rear wall near STA 383. Although other potential areas were assessed, no other area was found that so comprehensively explained the initial indications of odour and the subsequent smoke and fire propagation. Support for the fire initiating and spreading from this localized area includes the following:

• The presence of electrical wires as potential ignition sources and easily ignited MPET-covered insulation blanket material;
• The known environmental conditions in the cockpit and cabin;
• The time frame in which the fire propagated from initial detection until the fire-related failures of various aircraft systems occurred;
• The air-flow patterns; and
• The fire and heat-damage patterns.

Within the localized area where the fire most likely started, a wire arcing event is the only plausible ignition source. There were several wire bundles containing hundreds of wires, including the four IFEN PSU cables and 16 American Wire Gauge (AWG) control wire, that passed through the localized area (see Section 1.6.1.4). It is most likely that the fire started from a wire arcing event that ignited the nearby MPET-covered insulation blankets. These MPET-covered insulation blankets are easily ignited and were prevalent in the area (see Section 1.16.8).

Of all the wires and cables that were located in the localized area of interest, the only arc-damaged wire that could be positioned in that area with relative accuracy was the 1-3791/1-3793 pair of IFEN PSU cables (see Section 1.14.11.2). Although it is possible that other wires from this localized area that were not recovered might also have arced, the only arcing event that is known to have occurred within that area is the forward arc on Exhibit 1-3791, located just forward of STA 383.

An assessment was completed to determine whether the forward arc on Exhibit 1-3791 could have been the result of fire damage, and therefore, would not have been involved with the lead arcing event. This possibility was considered unlikely. For this forward arc on Exhibit 1-3791 to be the result of fire damage, the fire would have to start from another unrelated arcing event within the localized area, and the fire would need to be sustained in the area for a sufficient time to melt and breach the ETFE wire insulation at the site of the forward arc on Exhibit 1-3791. To result in arcing at this site, the breached wire would have to be in contact with either grounded aircraft structure, or with a second wire of different electrical potential whose insulation was also breached by the fire. It is unlikely that a fire would selectively breach only one wire in Exhibit 1-3791 and breach at least one additional nearby wire to create conditions for an arc event to occur without also breaching the insulation on at least some of the other five wires in the 1-3791/1-3793 pair. It is unlikely that the insulation on these other five wires was breached at that location, as there were no arcs on these five wires at that location.

The forward portions of the 1-3790 and 1-3792 PSU cables, and the 16 AWG control wire, were not identified and may not have been recovered. Therefore, in the area where the forward arcing event occurred on the 1-3791 PSU cable, it is not known whether arcing occurred on either the 1-3790/1-3792 cable pair, or the 16 AWG control wire. However, as both of these PSU cables and the 16 AWG control wire subsequently arced at locations that were at least 50 cm (20 inches) farther aft, any arcing that might have occurred at the forward location did not trip the associated CB.

Given the number of unlikely circumstances and events that would be required, a scenario involving fire-related damage leading to the forward arc on Exhibit 1-3791 at the STA 383 location cannot be supported.

If the forward arc on Exhibit 1-3791 was not the result of fire-related damage, another potential scenario is that the arc occurred during the time of the lead arcing event; that is, it was associated with the lead arcing event, either alone, in combination with arcing on another wire or wires, or as collateral damage from an arcing event on another adjacent wire or wires. In any of these potential scenarios, the arcing was not sufficient to trip the associated CB.

The forward arc on Exhibit 1-3791 was assessed to determine whether it was, by itself, the lead arcing event that started the fire. For this arc to be the single lead arcing event, the wire would first have to be damaged, for example by chafing, at the location of the arc, to expose the conductor. The exposed conductor would then have to contact grounded aircraft structure, resulting in the arcing event. Although it was possible to position the cable segment (Exhibit 1-3791), and therefore the forward arc, relatively accurately, the extent and nature of the damage required interpretation of the damage patterns. This interpretation allowed for a small range of possible locations in the placement of the wires, as described in Section 1.14.11.2. At the forward end of the possible range, the arc was placed where it would be in contact with an aluminum wire support bracket. However, the chafing of any one wire by itself to this bracket would not result in an arc, as the bracket was isolated from the aircraft structure by a nylon stand-off and would not have provided an electrical path to ground.

There was aluminum found in one copper bead adhering to the wire strands slightly removed from the main arc site of the forward arc bead on Exhibit 1-3791. This suggests that the arc might have resulted from contact with aluminum. Arcing to the aluminum bracket would only be possible if there were two exposed conductors in contact with the bracket. This would provide an opportunity for arcing, as aluminum is a good conductor of electricity. Such a scenario would involve, for example, two phases of a PSU cable chafing separately against this same bracket until both of their conductors became exposed. This scenario could not be ruled out; however, there is no corroborating information to support it. The bracket was not identified in the wreckage. Neither were the two remaining PSU cables, the 16 AWG control wire or other aircraft wires from that area, that may have been involved.

Another potential lead arcing event scenario involving the forward arc on Exhibit 1-3791 would be that the arc occurred directly to another wire of a different electrical potential. This could be either an aircraft wire, or another IFEN wire. In either case, both wires would have to be damaged at the location of the arc, allowing their bare conductors to contact each other. Because the IFEN wires in the STA 383 area were routed separately and not along existing wire bundles, it is less likely that the IFEN wires would be in contact with aircraft wires within the localized area where the fire most likely started; therefore, the more likely candidate wires for this type of scenario would be the other wires in the bundle of four IFEN PSU cables and the 16 AWG control wire. It is known that the other wires in the 1-3791/1-3793 pair did not arc at that forward location. However, the wires from the other pair of PSU cables and the 16 AWG control wire from that area were not identified. Therefore, neither aircraft wires nor other IFEN wires can be ruled out as potentially being involved in such a scenario.

Damage to two or more wires in a wire bundle can be caused by chafing contact with the aircraft structure, by inadvertent damage occurring during installation or subsequent maintenance, or by the presence of swarf, such as a metal shaving, that could cut through the insulation on both wires, exposing their conductors. A metal shaving could also act as a conductor. If any of those events occurred, the subsequent arcing that took place on all of the PSU cables and 16 AWG control wire confirms that any arcing on these wires near STA 383 did not trip the associated CB.

An assessment was made to determine whether the forward arcing damage on Exhibit 1-3791 could have resulted from collateral damage; that is, damage from an arcing event involving other wires in the immediate vicinity that was of sufficient magnitude to breach the insulation on at least two other wires, including Exhibit 1-3791. For this to occur, the lead-event wires would have to be in very close proximity to the forward arc on Exhibit 1-3791. An arcing event of sufficient magnitude to damage other wires would likely have tripped the associated CBs. None of the IFEN CBs tripped at the time of the lead arcing event (subsequent arcing occurred on all of the PSU cables and the 16 AWG control wire); therefore, if such an arcing event occurred, it did not involve IFEN wires. Such a lead-arcing event would have to involve aircraft wires, but not result in any electrical anomalies that would be apparent to the pilots and not be recorded on the FDR. Although the possibility of a scenario involving collateral damage to Exhibit 1-3791 could not be ruled out, it appears unlikely that such a scenario occurred.

No determination could be made regarding how the insulation at the forward arc location on Exhibit 1-3791 was initially breached, or what that wire came into contact with, such as structure or another wire, to cause the arc. Although the available information indicates that the forward arcing event on Exhibit 1-3791 occurred during the time of the fire-initiating event, and in the area where the fire most likely originated, it cannot be concluded that the forward arc on Exhibit 1-3791 was the lead arcing event. It appears likely that at least one other wire was involved in the lead arcing event; however, it could not be determined whether this was an IFEN wire or wires, one or more aircraft wires, or some combination of both.

An arcing event or events provided an ignition source for the fire; however, this arcing would not have resulted in a threat to the aircraft had there not been material nearby that could easily be ignited by such an ignition source. The presence of significant amounts of flammable materials allowed the fire to spread and intensify rapidly, which ultimately led to the loss of control of the aircraft.

3.1 Findings as to causes and contributing factors

These findings pertain to the unsafe acts, unsafe conditions, and safety deficiencies that are associated with events that played a major role in causing or contributing to the occurrence.

1. Aircraft certification standards for material flammability were inadequate in that they allowed the use of materials that could be ignited and sustain or propagate fire. Consequently, flammable material propagated a fire that started above the ceiling on the right side of the cockpit near the cockpit rear wall. The fire spread and intensified rapidly to the extent that it degraded aircraft systems and the cockpit environment, and ultimately led to the loss of control of the aircraft.
2. Metallized polyethylene terephthalate (MPET)–type cover material on the thermal acoustic insulation blankets used in the aircraft was flammable. The cover material was most likely the first material to ignite, and constituted the largest portion of the combustible materials that contributed to the propagation and intensity of the fire.
3. Once ignited, other types of thermal acoustic insulation cover materials exhibit flame propagation characteristics similar to MPET-covered insulation blankets and do not meet the proposed revised flammability test criteria. Metallized polyvinyl fluoride–type cover material was installed in HB-IWF and was involved in the in-flight fire.
4. Silicone elastomeric end caps, hook-and-loop fasteners, foams, adhesives, and thermal acoustic insulation splicing tapes contributed to the propagation and intensity of the fire.
5. The type of circuit breakers (CB) used in the aircraft were similar to those in general aircraft use, and were not capable of protecting against all types of wire arcing events. The fire most likely started from a wire arcing event.
6. A segment of in-flight entertainment network (IFEN) power supply unit cable (1-3791) exhibited a region of resolidified copper on one wire that was caused by an arcing event. This resolidified copper was determined to be located near manufacturing station 383, in the area where the fire most likely originated. This arc was likely associated with the fire initiation event; however, it could not be determined whether this arced wire was the lead event.
7. There were no built-in smoke and fire detection and suppression devices in the area where the fire started and propagated, nor were they required by regulation. The lack of such devices delayed the identification of the existence of the fire, and allowed the fire to propagate unchecked until it became uncontrollable.
8. There was a reliance on sight and smell to detect and differentiate between odour or smoke from different potential sources. This reliance resulted in the misidentification of the initial odour and smoke as originating from an air conditioning source.
9. There was no integrated in-flight firefighting plan in place for the accident aircraft, nor was such a plan required by regulation. Therefore, the aircraft crew did not have procedures or training directing them to aggressively attempt to locate and eliminate the source of the smoke, and to expedite their preparations for a possible emergency landing. In the absence of such a firefighting plan, they concentrated on preparing the aircraft for the diversion and landing.
10. There is no requirement that a fire-induced failure be considered when completing the system safety analysis required for certification. The fire-related failure of silicone elastomeric end caps installed on air conditioning ducts resulted in the addition of a continuous supply of conditioned air that contributed to the propagation and intensity of the fire.
11. The loss of primary flight displays and lack of outside visual references forced the pilots to be reliant on the standby instruments for at least some portion of the last minutes of the flight. In the deteriorating cockpit environment, the positioning and small size of these instruments would have made it difficult for the pilots to transition to their use, and to continue to maintain the proper spatial orientation of the aircraft.

3.2 Findings as to risk

These findings identify risks that have the potential to degrade aviation safety but that could not be shown to have played a direct role in the occurrence or are unrelated to this occurrence but were found during the investigation.

1. Although in many types of aircraft there are areas that are solely dependent on human intervention for fire detection and suppression, there is no requirement that the design of the aircraft provide for ready access to these areas. The lack of such access could delay the detection of a fire and significantly inhibit firefighting.
2. In the last minutes of the flight, the electronic navigation equipment and communications radios stopped operating, leaving the pilots with no accurate means of establishing their geographic position, navigating to the airport, and communicating with air traffic control.
3. Regulations do not require that aircraft be designed to allow for the immediate de-powering of all but the minimum essential electrical systems as part of an isolation process for the purpose of eliminating potential ignition sources.
4. Regulations do not require that checklists for isolating smoke or odours that could be related to an overheating condition be designed to be completed in a time frame that minimizes the possibility of an in-flight fire being ignited or sustained. As is the case with similar checklists in other aircraft, the applicable checklist for the MD-11 could take 20 to 30 minutes to complete. The time required to complete such checklists could allow anomalies, such as overheating components, to develop into ignition sources.
5. The Swissair Smoke/Fumes of Unknown Origin Checklist did not call for the cabin emergency lights to be turned on before the CABIN BUS switch was selected to the OFF position. Although a switch for these lights was available at the maître de cabine station, it is known that for a period of time the cabin crew were using flashlights while preparing for the landing, which potentially could have slowed their preparations.
6. Neither the Swissair nor Boeing Smoke/Fumes of Unknown Origin Checklist emphasized the need to immediately start preparations for a landing by including this consideration at the beginning of the checklist. Including this item at the end of the checklist de-emphasizes the importance of anticipating that any unknown smoke condition in an aircraft can worsen rapidly.
7. Examination of several MD-11 aircraft revealed various wiring discrepancies that had the potential to result in wire arcing. Other agencies have found similar discrepancies in other aircraft types. Such discrepancies reflect a shortfall within the aviation industry in wire installation, maintenance, and inspection procedures.
8. The consequence of contamination of an aircraft on its continuing airworthiness is not fully understood by the aviation industry. Various types of contamination may damage wire insulation, alter the flammability properties of materials, or provide fuel to spread a fire. The aviation industry has yet to quantify the impact of contamination on the continuing airworthiness and safe operation of an aircraft.
9. Heat damage and several arcing failure modes were found on in-service map lights. Although the fire in the occurrence aircraft did not start in the area of the map lights, their design and installation near combustible materials constituted a fire risk.
10. There is no guidance material to identify how to comply with the requirements of Federal Aviation Regulation (FAR) 25.1353(b) in situations where physical/spatial wire separation is not practicable or workable, such as in confined areas.
11. The aluminum cap assembly used on the stainless steel oxygen line above the cockpit ceiling was susceptible to leaking or fracturing when exposed to the temperatures that were likely experienced by this cap assembly during the last few minutes of the flight. Such failures would exacerbate the fire and potentially affect crew oxygen supply. It could not be determined whether this occurred on the accident flight.
12. Inconsistencies with respect to CB reset practices have been recognized and addressed by major aircraft manufacturers and others in the aviation industry. Despite these initiatives, the regulatory environment, including regulations and advisory material, remains unchanged, creating the possibility that such "best practices" will erode or not be universally applied across the aviation industry.
13. The mandated cockpit voice recorder (CVR) recording time was insufficient to allow for the capture of additional, potentially useful, information.
14. The CVR and the flight data recorder (FDR) were powered from separate electrical buses; however, the buses received power from the same generator; this configuration was permitted by regulation. Both recorders stopped recording at almost the same time because of fire-related power interruptions; independent sources of aircraft power for the recorders may have allowed more information to be recorded.
15. Regulations did not require the CVR to have a source of electrical power independent from its aircraft electrical power supply. Therefore, when aircraft electrical power to the CVR was interrupted, potentially valuable information was not recorded.
16. Regulations and industry standards did not require quick access recorders (QAR) to be crash-protected, nor was there a requirement that QAR data also be recorded on the FDR. Therefore, potentially valuable information captured on the QAR was lost.
17. Regulations did not require the underwater locator beacon attachments on the CVR and the FDR to meet the same level of crash protection as other data recorder components.
18. The IFEN Supplemental Type Certificate (STC) project management structure did not ensure that the required elements were in place to design, install, and certify a system that included emergency electrical load-shedding procedures compatible with the MD-11 type certificate. No link was established between the manner in which the IFEN system was integrated with aircraft power and the initiation or propagation of the fire.
19. The Federal Aviation Administration (FAA) STC approval process for the IFEN did not ensure that the designated alteration station (DAS) employed personnel with sufficient aircraft-specific knowledge to appropriately assess the integration of the IFEN power supply with aircraft power before granting certification.
20. The FAA allowed a de facto delegation of a portion of their Aircraft Evaluation Group function to the DAS even though no provision existed within the FAA's STC process to allow for such a delegation.
21. FAR 25.1309 requires that a system safety analysis be accomplished on every system installed in an aircraft; however, the requirements of FAR 25.1309 are not sufficiently stringent to ensure that all systems, regardless of their intended use, are integrated into the aircraft in a manner compliant with the aircraft's type certificate.
22. Approach charts for the Halifax International Airport were kept in the ship's library at the observer's station and not within reach of the pilots. Retrieving these charts required both time and attention from the pilots during a period when they were faced with multiple tasks associated with operating the aircraft and planning for the landing.
23. While the SR Technics quality assurance (QA) program design was sound and met required standards, the training and implementation process did not sufficiently ensure that the program was consistently applied, so that potential safety aspects were always identified and mitigated.
24. The Swiss Federal Office for Civil Aviation audit procedures related to the SR Technics QA program did not ensure that the underlying factors that led to specific similar audit observations and discrepancies were addressed.

3.3 Other findings

These findings identify elements that have the potential to enhance aviation safety, resolve an issue of controversy, or clarify an issue of unresolved ambiguity.

1. The Royal Canadian Mounted Police found no evidence to support the involvement of any explosive or incendiary device, or other criminal act in the initiation of the in-flight fire.
2. The 13-minute gap in very-high frequency communications was most likely the result of an incorrect frequency selection by the pilots.
3. The pilots made a timely decision to divert to the Halifax International Airport. Based on the limited cues available, they believed that although a diversion was necessary, the threat to the aircraft was not sufficient to warrant the declaration of an emergency or to initiate an emergency descent profile.
4. The flight crew were trained to dump fuel without restrictions and to land the aircraft in an overweight condition in an emergency situation, if required.
5. From any point along the Swissair Flight 111 flight path after the initial odour in the cockpit, the time required to complete an approach and landing to the Halifax International Airport would have exceeded the time available before the fire-related conditions in the aircraft cockpit would have precluded a safe landing.
6. Air conditioning anomalies have typically been viewed by regulators, manufacturers, operators, and pilots as not posing a significant and immediate threat to the safety of the aircraft that would require an immediate landing.
7. Actions by the flight crew in preparing the aircraft for landing, including their decisions to have the passenger cabin readied for landing and to dump fuel, were consistent with being unaware that an on-board fire was propagating.
8. Air traffic controllers were not trained on the general operating characteristics of aircraft during emergency or abnormal situations, such as fuel dumping.
9. Interactions between the pilots and the controllers did not affect the outcome of the occurrence.
10. The first officer's seat was occupied at the time of impact. It could not be determined whether the captain's seat was occupied at the time of impact.
11. The pilots shut down Engine 2 during the final stages of the flight. No confirmed reason for the shutdown could be established; however, it is possible that the pilots were reacting to the illumination of the engine fire handle and FUEL switch emergency lights. There was fire damage in the vicinity of a wire that, if shorted to ground, would have illuminated these lights.
12. When the aircraft struck the water, the electrically driven standby attitude indicator gyro was still operating at a high speed; however, the instrument was no longer receiving electrical power. It is unknown whether the information displayed at the time of impact was indicative of the aircraft attitude.
13. Coordination between the pilots and the cabin crew was consistent with company procedures and training. Crew communications reflected that the situation was not being categorized as an emergency until about six minutes prior to the crash; however, soon after the descent to Halifax had started, rapid cabin preparations for an imminent landing were underway.
14. No smoke was reported in the cabin by the cabin crew at any time prior to CVR stoppage; however, it is likely that some smoke would have been present in the passenger cabin during the final few minutes of the flight. No significant heat damage or soot build-up was noted in the passenger seating areas, which is consistent with the fire being concentrated above the cabin ceiling.
15. No determination could be made about the occupancy of any of the individual passenger seats. Passenger oxygen masks were stowed at the time of impact, which is consistent with standard practice for an in-flight fire.
16. No technically feasible link was found between known electromagnetic interference/high-intensity radiated fields and any electrical discharge event leading to the ignition of the aircraft's flammable materials.
17. Regulations did not require the recording of cockpit images, although it is technically feasible to do so in a crash-protected manner. Confirmation of information, such as flight instrument indications, switch position status, and aircraft system degradation, could not be completed without such information.
18. Portions of the CVR recording captured by the cockpit area microphone were difficult to decipher. When pilots use boom microphones, deciphering internal cockpit CVR communications becomes significantly easier; however, the use of boom microphones is not required by regulation for all phases of flight. Nor is it common practice for pilots to wear boom microphones at cruise altitude.
19. Indications of localized overheating were found on cabin ceiling material around overhead aisle and emergency light fixtures. It was determined that the overhead aisle and emergency light fixtures installed in the accident aircraft did not initiate the fire; however, their design created some heat-related material degradation that was mostly confined to the internal area of the fixtures adjacent to the bulbs.
20. At the time of this occurrence, there was no requirement within the aviation industry to record and report wiring discrepancies as a separate and distinct category to facilitate meaningful trend analysis in an effort to identify unsafe conditions associated with wiring anomalies.

Based on the safety deficiencies identified in this occurrence, the Board has issued a series of safety communications. Initiatives undertaken by others to enhance safety have also been identified. This part presents the following information:

• Safety actions taken—initiatives undertaken by aviation regulatory authorities and others;
• Safety actions required—recommendations the Board considers necessary to address systemic safety deficiencies posing the highest risk; and
• Safety concerns—issues the Board has deemed do not warrant recommendations at this time but that provide a marker to the industry and regulatory authorities.

Those issues dealing with systemic safety deficiencies are communicated to government aviation regulators, the aviation industry, and the public in the form of an Aviation Safety Recommendation (ASR). Safety deficiencies that are deemed to present lesser risks are communicated through either an Aviation Safety Advisory (ASA) or an Aviation Safety Information Letter (ASIL). In addition, informal communications with various stakeholders and the provision of public briefings complement the Transportation Safety Board of Canada's (TSB) formal safety communications.

4.1 Action taken

This section is organized chronologically according to the TSB's safety communications. Each safety communication is followed by associated safety action undertaken by various stakeholders, Transport Canada (TC), the United States (US) National Transportation Safety Board (NTSB), the US Federal Aviation Administration (FAA), Boeing, Swissair, SR Technics, and so on.

4.1.1 MD-11 wiring

4.1.1.1 Transportation Safety Board of Canada

Aircraft wiring was of immediate and ongoing interest to the investigation team. The team inspected several MD-11 aircraft in order to identify potential areas of arcing or sources of heat generation. These inspections yielded wiring discrepancies that included chafed, cut, and cracked wires. Inconsistencies in wire and wire bundle routing were also discovered, which raised concern about the overall integrity of the MD-11's wiring system. While the investigation team could not establish a direct relationship between the in-service wiring discrepancies and the wires recovered in the Swissair Flight 111 (SR 111) wreckage, the team felt that the data warranted a wider review to better define the risk to the MD-11 fleet. Therefore, on 22 December 1998, the TSB sent an ASA (980031-1) to the NTSB concerning the MD-11 wiring issues.

See the supporting technical information on this topic.

4.1.1.2 United States National Transportation Safety Board

Shortly after receiving the TSB's ASA (980031-1), on 11 January 1999, the NTSB recommended that the FAA require an inspection of all MD-11 aircraft for wiring discrepancies (NTSB Recommendation A-99-3 available at http://www.ntsb.gov). The NTSB recommended that the inspection concentrate in and around the cockpit overhead circuit breaker (CB) panel and the avionics CB panel. The inspection should also include examinations for loose wire connections, inconsistent wire routing, broken bonding wires, small-wire bend radii, and chafed or cracked wire insulation.

4.1.1.3 United States Federal Aviation Administration

In early 1999, the FAA responded to the NTSB's recommendation by issuing an MD-11 Airworthiness Directive (AD) requiring inspections to determine whether wiring discrepancies exist that could cause electrical arcing. Such arcing could cause a fire or smoke or both in the cockpit or cabin. Based on the results of these inspections, the FAA launched a two-phase MD-11 Wiring Corrective Action Plan. The first phase consisted of three ADs that focused on the areas of concern highlighted in the TSB's safety advisory. Subsequently, the FAA, working closely with Boeing, launched the second phase, which consisted of five Corrective Action Packages, each comprising a series of ADs. Each AD was based on a Boeing-generated MD-11 Service Bulletin (SB). As of 10 May 2002, the MD-11 Wiring Corrective Action Plan had yielded 41 related ADs with additional SBs undergoing Notice of Proposed Rulemaking (NPRM) review.

In a parallel initiative, the FAA used lessons learned from the SR 111 investigation to shape its "Aircraft Wiring Practices" interactive training program for FAA certification engineers, designated engineering representatives, and aviation safety inspectors. In addition, the FAA has produced an Internet-based training aid entitled, "Aircraft Wiring Practices (Job Aid)" (available at http://www.academy.jccbi.gov/airdl/wiringcourse/index.htm).

In August 2001, the FAA launched the Enhanced Airworthiness Program for Airplane Systems (EAPAS), designed to address the realities of an aging transport aeroplane fleet. Presently, EAPAS is focused on aging wiring systems. Short-term objectives are those that raise awareness of aging wiring systems, and that implement basic changes to maintenance and training programs. Long-term objectives will concentrate on institutionalizing the management of aging wiring systems.

During the course of this investigation, the FAA requested that the Air Transport Association introduce a new reporting code (sub-chapter 97) to facilitate more accurate tracking of specific wire-related problems and anomalies.

4.1.1.4 The Boeing Company

In addition to its integral support for the FAA's MD-11 Wiring Corrective Action Plan, Boeing responded to the need for additional technical training with respect to wiring by developing a wiring inspection course for airline and government agencies. Furthermore, these initiatives have resulted in enhancements to Boeing's Standard Wiring Practices Manual.

4.1.1.5 Swissair

The need to enhance technical training with respect to wiring was also recognized by Swissair. Subsequently, SR Technics revised its technician training syllabus to include such topics as wire cleanliness, handling, protection, and grounding. They have also developed a series of engineering orders to comply with all applicable ADs called for in the FAA's MD-11 Wiring Corrective Action Plan, and have mandated several special inspections related to wiring issues.

4.1.1.6 Swiss Federal Office for Civil Aviation

As is the practice of the Swiss Federal Office for Civil Aviation (FOCA), all ADs issued by the FAA in relation to the MD-11 wiring issue have been reviewed and reissued as Swiss ADs.

4.1.2 Flight recorder duration and power supply

4.1.2.1 Transportation Safety Board of Canada

Shortcomings related to the duration of cockpit voice recorder (CVR) recordings and the supply of electrical power to the flight data recorder (FDR) have been identified during this and other aircraft accident investigations. Consequently, on 9 March 1999, the TSB issued four ASRs (A99-01 through A99-04) to TC and the Joint Aviation Authorities (JAA), dealing with CVR duration, independent power supply, and the use of separate electrical buses.

A lack of recorded voice and other aural information can inhibit safety investigations, and delay or prevent the identification of safety deficiencies. Given the need for longer periods of recorded sound to capture the initiating events of aviation accidents, and the availability of two-hour CVRs, the TSB believed that such recorders should be mandated by regulatory authorities worldwide. However, it also recognizes that a period of several years may be reasonably required for manufacturers and operators to implement this change. Therefore, for newly manufactured aircraft, the TSB made the following recommendation:

As of 01 January 2003, any CVR installed on an aircraft as a condition of that aircraft receiving an original certificate of airworthiness be required to have a recording capacity of at least two hours.
TSB Recommendation A99-01 (issued 9 March 1999)

In addition, the TSB believes that, with appropriate lead time, a retrofit program is warranted for aircraft already in service. Therefore, the TSB made the following recommendation:

As of 01 January 2005, all aircraft that require both an FDR and a CVR be required to be fitted with a CVR having a recording capacity of at least two hours.
TSB Recommendation A99-02 (issued 9 March 1999)

When aircraft power to the SR 111 flight recorders was interrupted at 10 000 feet, the FDR and CVR stopped recording. The aircraft continued to fly for about six minutes with no on-board information being recorded. This lack of recorded information hampered the accident investigation.

With maintenance-free independent power sources, it is now feasible to power new-technology CVRs and the cockpit area microphone (CAM) independently of normal aircraft power for a specific period of time in the event that aircraft power sources to the CVR are interrupted or lost. Therefore, to enhance the capture of CVR information needed for accident investigation purposes, the TSB made the following recommendation:

As of 01 January 2005, for all aircraft equipped with CVRs having a recording capacity of at least two hours, a dedicated independent power supply be required to be installed adjacent or integral to the CVR, to power the CVR and the cockpit area microphone for a period of 10 minutes whenever normal aircraft power sources to the CVR are interrupted.
TSB Recommendation A99-03 (issued 9 March 1999)

At the time of the occurrence, FDR and CVR installation in MD-11 aircraft were both powered from AC Generator Bus 3. The Smoke/Fumes of Unknown Origin Checklist (see Appendix C — Swissair Smoke/Fumes of Unknown Origin Checklist) requires the use of the SMOKE ELEC/AIR selector. This switch is used to cut power to each of the three electrical buses in turn in order to isolate the source of the smoke/fumes. The nature of this troubleshooting procedure requires that the switch remain in each position for an indeterminate amount of time, typically at least a few minutes. When the SMOKE ELEC/AIR selector is in the first (3/1 OFF) position, alternating current (AC) Generator Bus 3 is turned off, thereby simultaneously disabling the FDR and the CVR.

With both the CVR and the FDR on the same generator bus, a failure of that bus, or the intentional disabling of the bus (e.g., the result of checklist actions in an emergency), will result in both recorders losing power simultaneously. To enhance the capture of information needed for the identification of safety deficiencies, the TSB made the following recommendation:

Aircraft required to have two flight recorders be required to have those recorders powered from separate generator buses.
TSB Recommendation A99-04 (issued 9 March 1999)

See the supporting technical information on this topic.

4.1.2.2 United States National Transportation Safety Board

Coincidently, the NTSB issued recommendations A-99-16 through A-99-18 to the FAA, which contain the same elements as the TSB recommendations. The NTSB also recommended that aircraft be fitted with two combination CVR/digital flight data recorder (DFDR) recording systems. As described in Section 4.1.2.3, the FAA has yet to begin NPRM action in response to the NTSB recommendations. As of 25 July 2001, the NTSB regarded as unacceptable the amount of progress made in the two years since the recommendations were issued. The NTSB continues to urge the FAA to act expeditiously on these recommendations but remains sceptical that the dates for final action can be met.

4.1.2.3 United States Federal Aviation Administration

The FAA agreed with the intent of the NTSB recommendations and indicated that it would initiate NPRM action by the end of summer 1999. By August 1999, the FAA advised the NTSB that because of competing priorities, the NPRM would be delayed until March 2000. Responding to an update request from the NTSB dated June 2000, the FAA announced in April 2001 that rulemaking based on the CVR/FDR recommendations would be further delayed until the end of 2001. As of this writing, the FAA advises that NPRM action will take place in the spring of 2003.

4.1.2.4 Transport Canada

TC responded to the TSB's recommendations with respect to flight recorders and power supply by indicating that it was TC's intention to harmonize its position with the JAA and address the FAA's NPRMs at an appropriate Canadian Aviation Regulation Advisory Council meeting. Therefore, TC's implementation timetable is linked to the FAA schedule.

4.1.2.5 The Boeing Company

Boeing published SB MD11-31-101 on 19 December 2001, which allows MD-11 recorders to be powered by separate buses. Incorporation of the SB will result in the CVR being powered by the right emergency bus, and the digital flight data acquisition unit/DFDR by the Engine 1 AC generator bus.

4.1.3 Thermal acoustic insulation materials

4.1.3.1 Transportation Safety Board of Canada

As of August 1999, the SR 111 investigation had revealed fire damage in the ceiling area forward, and several metres aft, of the cockpit wall. There were clear indications that a significant source of the combustible materials that sustained the fire was thermal acoustic insulation blanket (insulation blanket) materials. Burnt remnants of this material, caused by the in-flight fire, were found in the wreckage; the fire was extinguished upon impact with the water.

Shortcomings related to the in-service fire resistance of some thermal acoustic insulation materials, and weaknesses in the test criteria used to certify those materials, have been identified during this and other recent aircraft occurrence investigations. Subsequently, the TSB issued recommendations (A99-07 and A99-08) dealing with the risks associated with the flammability of metallized polyethylene terephthalate (MPET)—covered insulation blankets and the test criteria that certified this material for aircraft use.

The in-service history; the demonstrated flammability of the MPET cover material; and the discovery, in the SR 111 wreckage, of remnants of insulation blankets with burnt cover material suggest that MPET cover material was a significant source of the combustible materials that propagated the fire. It is the TSB's view that the operation of aircraft outfitted with insulation blankets incorporating MPET cover material constitutes an unnecessary risk. Therefore, the TSB made the following recommendation:

Regulatory authorities confirm that sufficient action is being taken, on an urgent basis, to reduce or eliminate the risk associated with the use of metallized PET-covered insulation blankets in aircraft.
TSB Recommendation A99-07 (issued 11 August 1999)

A review of incidents involving cover materials other than those involving MPET (e.g., non-metallized polyethylene terephthalate) polyester film revealed that the limitations of Federal Aviation Regulation (FAR) 25.853, Appendix F, test criteria may not be confined to its inability to accurately and reliably identify the flammability characteristics of MPET-type cover material.

On 14 October 1998, the FAA stated that the test criteria used to certify the flammability characteristics of thermal acoustic insulation materials were inadequate, and committed itself to conduct the research necessary to establish a more comprehensive test standard. At the same time, the FAA indicated that because materials containing polyimide film have performed well in preliminary flammability tests, these materials would be considered compliant under the new regulation. Until adequate flammability test criteria are available, it is not possible to determine whether polyimide film, or other materials, provide adequate protection against fire propagation. Thermal acoustic insulation materials are installed in aircraft as a system, including such related components as tape, fasteners, and breathers. The TSB believed that thermal acoustic insulation materials for use in aircraft must be judged against more valid flammability test criteria—not as individual components, but as a system. Therefore, the TSB made the following recommendation:

On an urgent basis, regulatory authorities validate all thermal acoustical insulation materials in use, or intended for use, in applicable aircraft, against test criteria that are more rigorous than those in Appendix F of FAR 25.853, and similar regulations, and that are representative of actual in-service system performance.
TSB Recommendation A99-08 (issued 11 August 1999)

See the supporting technical information on this topic.

4.1.3.2 United States Federal Aviation Administration

The FAA responded to TSB recommendation A99-07 by issuing two NPRMs (99-NM-161-AD and 99-NM-162-AD). The NPRMs proposed the removal of MPET-covered insulation blankets from all US-registered aircraft. The final rule regarding these proposals came in May 2000 when the FAA issued two ADs (AD 2000-11-01 and AD 2000-11-02 available at http://www.faa.gov), which required the removal of all MPET-covered insulation blankets. These ADs were based on existing McDonnell Douglas (MD) SBs, which call for the replacement of the MPET-covered insulation blankets.

In response to TSB recommendation A99-08, the FAA accelerated a project to develop an improved certification flammability test for all thermal acoustic insulation materials. An NPRM (Docket FAA-2000-7909; Notice 00-09) was issued in September 2000 and the final rule is on hold pending a plain language review and rewrite. In the interim, the FAA issued Flight Standards Information Bulletin for Airworthiness 00-09 to ensure that 14 Code of Federal Regulations (CFR) Parts 121 and 125 operators have established procedures for the inspection of thermal acoustic insulation materials for any contamination during heavy maintenance checks.

4.1.3.3 Transport Canada

Although there are currently no aircraft in the Canadian register built with MPET-covered insulation blankets, TC conducted a survey to confirm that no Canadian-registered aircraft had used MPET-covered insulation blankets during a wholesale replacement program. Additionally, they worked with Bombardier Inc. to remove MPET-type tape from their RJ Series 700 specification.

4.1.3.4 Swissair

Prior to issuing the FAA ADs regarding MPET-covered insulation material, Swissair worked with Boeing to identify the high-risk areas of the MD-11 aircraft and by March 2001 had voluntarily replaced selected MPET-covered insulation blankets. Upon receipt of the FAA's AD 2000-11-02, Swissair began a complete MPET-covered insulation blankets replacement program on their MD-11 fleet. As of January 2003, the AD had been accomplished on 11 MD-11s previously owned by Swissair.

4.1.3.5 Swiss Federal Office for Civil Aviation

The Swiss FOCA reviewed and reissued AD 2000-11-02 as a   Swiss AD 2000-414.

4.1.4 MD-11 flight crew reading light (Map light)

4.1.4.1 Transportation Safety Board of Canada

During an MD-11 wiring inspection carried out as part of an insulation blanket replacement program, it was noted that an insulation blanket was in contact with the upper part of the recessed map light installed on the right side of the cockpit ceiling. The MPET-covered insulation material had been imprinted and mechanically damaged by the back of the map light fixture, which houses a halogen lamp. Also, one of the ring terminal insulators attached to a wire lead that was attached to the map light, exhibited heat damage. Examination of the left map light found similar but lesser damage. No damage was reported for the observer station map light installations.

This discovery prompted an inspection of 12 additional MD-11 aircraft, which revealed various discrepancies, including cracked protective covers, repairs not in accordance with the component maintenance manual, heat deformation, evidence of arcing, and heat discolouration.

In light of the identified flammability risks associated with MPET-covered insulation blankets, the TSB forwarded an ASA (A000008-1) to the NTSB so that it could review these preliminary findings and forward them to the FAA.

Subsequently, the SR 111 investigation revealed additional failure modes associated with the map light installation. On 29 December 2000, the TSB issued an ASIL (A000061-1) apprising stakeholders of these developments.

See the supporting technical information on this topic.

4.1.4.2 United States National Transportation Safety Board

The NTSB agreed that more should be done to determine the extent of the problem and sent a letter to the FAA encouraging it to take whatever action necessary to alleviate the problems outlined in TSB's ASA A000008-1.

4.1.4.3 United States Federal Aviation Administration

Based on Boeing's Alert Service Bulletin (MD-11 33A069), the FAA issued AD 2000-07-02, which mandated a recurring inspection for the affected lights in the MD-11 cockpit. In January 2001, this AD was superseded by AD 2000-26-15, which required operators of affected aircraft equipped with map lights, as part of their aircraft's "Skybunk" installations, to include these as part of the original recurring inspection requirement. On 15 May 2001, the FAA approved the Hella SB 2LA005916-33-003 as an alternate means of compliance. While incorporating this SB does not terminate the AD, it changes the inspection cycle from every 700 hours to once a year. The AD will remain in force until such time as the unsafe condition related to the map light has been eliminated.

4.1.4.4 Hella Aerospace

Hella Aerospace is working with Boeing to develop various design improvements to address the map light failure modes discovered during the SR 111 investigation. Proposed design changes include reinforced contact spring protective covers to minimize possibility of cracking and breakage, use of protective covers on the carrier frame to avoid metal-to-metal contact, relocation of spare bulb holder to avoid contact with the ON/OFF switch, and reforming of support brackets to reduce possibility of contact with terminal lugs. As an interim measure, Hella issued SB 2LA005916-33-003 dated 12 December 2000, which incorporates some of these changes. Hella advises that a successful design review, in cooperation with Boeing Engineering, took place in August 2002. Documentation regarding the final flight crew reading light (FCRL) redesign has been forwarded to Boeing and production of the new map light series, based on these product improvements, began in November 2002.

4.1.4.5 Swiss Federal Office for Civil Aviation

The Swiss FOCA reviewed and reissued AD 2000-07-02 as Swiss AD 2000-246 and AD 2000-26-15 as Swiss AD 2001-109.

4.1.4.6 Swissair

In June 2001, SR Technics issued engineering order (EO) 217609.01 to incorporate Hella's SB 2LA005916-33-003. The EO modifies the FCRL (map light) to improve its short-circuit protection. This is accomplished in a variety of ways, including the replacement of the 11.5 watt (W) halogen lamp with a 7.0 W incandescent bulb. SR Technics advises that the EO was fully implemented as of March 2002.

4.1.5 In-flight firefighting

4.1.5.1 Transportation Safety Board of Canada

The SR 111 investigation identified safety deficiencies associated with in-flight firefighting measures. Subsequently, the TSB issued five ASRs (A00-16 through A00-20)that identified safety deficiencies with respect to in-flight firefighting. The identified safety deficiencies increase the time required to assess and gain control of what could be a rapidly deteriorating situation and reflect a weakness in the efforts of governments and industry to recognize the need for dealing with in-flight fire in a systematic and effective way.

The TSB believes that the risk to the flying public can be reduced by re-examining fire-zone designations in order to identify additional areas of the aircraft that should be equipped with enhanced smoke/fire detection and suppression systems. Therefore, the TSB made the following recommendation:

Appropriate regulatory authorities, together with the aviation community, review the methodology for establishing designated fire zones within the pressurized portion of the aircraft, with a view to providing improved detection and suppression capability.
TSB Recommendation A00-17 (issued 4 December 2000)

Along with initiating the other elements of a comprehensive firefighting plan, it is essential that flight crews give attention, without delay, to preparing the aircraft for a possible landing at the nearest suitable airport. Therefore, the TSB made the following recommendation:

Appropriate regulatory authorities take action to ensure that industry standards reflect a philosophy that when odour/smoke from an unknown source appears in an aircraft, the most appropriate course of action is to prepare to land the aircraft expeditiously.
TSB Recommendation A00-18 (issued 4 December 2000)

Aircraft accident data indicate that a self-propagating fire can develop quickly. Therefore, odour/smoke checklists must be designed to ensure that the appropriate troubleshooting procedures are completed quickly and effectively. The TSB is concerned that this is not the case, and made the following recommendation:

Appropriate regulatory authorities ensure that emergency checklist procedures for the condition of odour/smoke of unknown origin be designed so as to be completed in a time frame that will minimize the possibility of an in-flight fire being ignited or sustained.
TSB Recommendation A00-19 (issued 4 December 2000)

An uncontrollable in-flight fire constitutes a serious and complicated emergency. A fire may originate from a variety of sources, and can propagate rapidly. Time is critical. Aircraft crews must be knowledgeable about the aircraft and its systems, and be trained to combat any fire quickly and effectively in all areas, including those that may not be readily accessible. The TSB believes that the lack of comprehensive in-flight firefighting procedures, and coordinated aircraft crew training to use such procedures, constitutes a safety deficiency. Therefore, the TSB made the following recommendation:

Appropriate regulatory authorities review current in-flight firefighting standards including procedures, training, equipment, and accessibility to spaces such as attic areas to ensure that aircraft crews are prepared to respond immediately, effectively and in a coordinated manner to any in-flight fire.
TSB Recommendation A00-20 (issued 4 December 2000)

In-flight firefighting "systems" should include all procedures and equipment necessary to prevent, detect, control, and eliminate fires in aircraft. This systems approach would include material flammability standards, accessibility, smoke/fire detection and suppression equipment, emergency procedures and training. All of these components should be examined together and the inter-relationships between individual firefighting measures should be reassessed with a view to developing improved, comprehensive firefighting measures. The TSB believes that an in-flight firefighting system, developed according to a systematic approach and consisting of complementary elements, would result in the most effective in-flight firefighting system; therefore, the TSB made the following recommendation:

Appropriate regulatory authorities, in conjunction with the aviation community, review the adequacy of in-flight firefighting as a whole, to ensure that aircraft crews are provided with a system whose elements are complementary and optimized to provide the maximum probability of detecting and suppressing any in-flight fire.
TSB Recommendation A00-16 (issued 4 December 2000)

See the supporting technical information on this topic.

4.1.5.2 United States Federal Aviation Administration/Transport Canada

Both the FAA and TC concurred with the TSB's position with respect to in-flight firefighting, and have advised that a review of existing programs is underway. Upon completion of the review, both regulators, in conjunction with the JAA, will take a harmonized approach to improving the in-flight firefighting system. As of March 2002, the program review involved the following activities:

• Developing fire tests for materials in inaccessible areas;
• Developing the most effective means to gain access to hidden areas for the firefighting purposes;
• Determining the feasibility of fire detection and suppression systems in inaccessible areas;
• Exploring the feasibility of water spray and nitrogen suppression systems;
• Developing improved fire/smoke detection systems;
• Developing ultra fire-resistant interior materials;
• Enhancing tools to allow for accurate risk assessment of aircraft wiring system threats;
• Developing new CB technology to prevent the harmful effects of arcing and arc tracking; and
• Developing certification criteria for new fire detector sensor technology.

4.1.5.3 The Boeing Company

Boeing issued a Flight Operations Bulletin (MD-11-99-04) to all MD-11 operators that discussed various options for dealing with smoke in the cockpit. Boeing also established a Boeing Smoke/Fire Committee to study the operational impact of smoke and fire events on each Boeing-manufactured aircraft.

4.1.5.4 Swissair

4.1.5.4.1 MD-11 checklists

Swissair issued an Aircraft Operations Manual (AOM) Bulletin (90/99) advising its MD-11 flight crews of a revision to the Smoke/Fumes of Unknown Origin Checklist (see Appendix C — Swissair Smoke/Fumes of Unknown Origin Checklist). Swissair decided to change the checklist to ensure that the EMER LT switch is selected before the CABIN BUS switch is selected. This change was based on an incident on a flight from Singapore to Zurich, during which the cabin crew had to deal with a "dark cabin" after the CABIN BUS switch had been selected. By design, the emergency lights in the cabin do not come on by selecting the CABIN BUS switch to the OFF position, even if the emergency lights are armed.

To save time when following this checklist, Swissair also instructed its MD-11 flight crews to proceed directly to the SMOKE ELEC/AIR selector checklist item, thereby eliminating the requirement to evaluate the results of de-powering the cabin bus and the need to restore power to the cabin bus.

In March 1999, after intensive discussion with the aircraft manufacturer on the new revision, Swissair conducted a test flight in aircraft HB-IWR to validate the new checklist procedure.

Swissair issued an AOM Bulletin (94/99) to advise its MD-11 flight crews about supplemental information on in-flight smoke/fire. The AOM Bulletin describes the Boeing Flight Operations Bulletin MD-11-99-04, "Supplemental Information to MD-11 Flight Crews on Inflight Smoke/Fire Procedures."

In 1993, the MD-11 manufacturer had decided to eliminate the Air Conditioning Smoke Checklist (see Appendix B — Swissair Air Conditioning Smoke Checklist) because all items covered in this checklist were included in the Smoke/Fumes of Unknown Origin Checklist. However, at this time, Swissair decided to keep the Air Conditioning Smoke Checklist because that checklist would provide a faster method of isolating the specific source of smoke/fumes when they were known to be coming from the air conditioning system. Swissair considered the use of this Air Conditioning Smoke Checklist to be less disruptive to aircraft systems, such as flight displays, communications and navigation systems, than the use of the Smoke/Fumes of Unknown Origin Checklist, which requires the generator buses to be turned off sequentially.

In AOM Bulletin (94/99), Swissair also advised its MD-11 flight crews about a revision to its emergency procedures with respect to dealing with smoke and fumes. Swissair indicated that "under certain circumstances the identification of a smoke source could be very difficult and that in some scenarios, where the air conditioning system acts as transportation media but does not represent the smoke source itself, this could lead to misinterpretation of the smoke origin." To standardize with the manufacturer, as well as to clarify and expedite the smoke source identification process, Swissair decided to use the Smoke/Fumes of Unknown Origin Checklist in any given smoke/fumes situation. Swissair cautioned its flight crews that the Smoke/Fumes of Unknown Origin Checklist "will lead to a shutdown of essential aircraft systems."^{Footnote 121} In addition, Swissair amended the Smoke/Fumes of Unknown Origin Checklist to advise flight crews—at the beginning of the checklist rather than at the end—to consider emergency landing, ditching, and fuel dumping.

Swissair issued an AOM Bulletin (111/00) to advise its MD-11 flight crews about a revision to its Smoke/Fumes of Unknown Origin Checklist. OXYGEN MASKS was added as the first item in the Smoke/Fumes of Unknown Origin Checklist. This addition did not represent a change to Swissair practices, as donning an oxygen mask had always been the first memory item when dealing with smoke situations in simulator training. Subsequently, in AOM Bulletin (122/01) Swissair explained the reasons behind the dramatic changes in the presentation of the Smoke/Fumes of Unknown Origin Checklist procedure. This same bulletin informed the MD-11 flight crews that Airbus has combined three "smoke" procedures into one checklist procedure similar to the MD-11 Smoke/Fumes of Unknown Origin Checklist.

4.1.5.4.2 Training

Swissair continued to educate its MD-11 flight crews through AOM Bulletins and Info Flashes (an internal newsletter) on its CB reset policies, checklist revisions, and incidents that involve smoke or odours. Flight crews were informed about increased inspections of map lights owing to heat damage discovered during maintenance.

In recent years, Swissair has revised its ground school refresher training to include briefings based, in part, on the SR 111 experience. The briefings were meant to emphasize the need for effective communications and timely decision making when dealing with smoke of unknown origin.

Swissair revised the part of its cockpit (or crew) resource management training program dealing with smoke emergencies. The program, attended by both pilots and cabin crew, consists of a day of lectures and reaffirmed the company's policies with regard to the new policies and procedures.

4.1.5.4.3 MD-11 modification plus program

In the post-accident environment, Swissair and its maintenance provider, SR Technics, undertook a joint study to analyze all potential factors that may have contributed to the accident. The study focused on exploiting opportunities to minimize the vulnerability of the MD-11 aircraft to an in-flight fire by developing an early warning smoke detection system. The stated intention was to enhance the firefighting and emergency response capability of the MD-11 and not to call into question the type certification of the aircraft. The study resulted in the adoption of the "MD-11 Modification Plus" program.

The program consists of the following enhancements:

• Miscellaneous Smoke Detector System: This modification installs smoke detectors in the avionics compartment, the cockpit overhead area, and the first-class galley overhead zone of the MD-11. The system consists of a dual-loop smoke detector system, which illuminates an amber MISC SMOKE warning light on the glareshield control panel, together with an aural warning. An emergency checklist entitled MISC SMOKE was created and introduced to the MD-11 crews via AOM Bulletin (123/01).
• Video Camera Monitoring System: This system installs cameras in the avionics compartment, the cockpit overhead area, and the first-class galley overhead zone to provide a visual confirmation of the presence of smoke. The camera installation includes a dedicated display screen, located on the centre pedestal, to allow the pilots to view the area of interest.
• Halon Distribution System: This system consists of three fixed Halon bottles connected to a distribution system. The HDS can direct a fire-suppressing agent to the cockpit overhead area, and the first-class galley overhead zone. As these areas are not readily accessible, this modification optimizes the aircraft crew's fire-suppression capabilities.
• Wire Routing: This part of the program includes a wiring modification designed to enhance separation and increase survivability of flight-critical systems. The modification physically separates the left and right power wires to opposite sides of the cockpit.
• Oxygen System/Air Conditioning System Improvements: As a fire-hardening measure for its crew oxygen system, Swissair incorporated Boeing's SB MD11-35-021, which replaces aluminium components with steel. Additionally, Swissair has replaced the end caps used in the air conditioning system ducting with a more fire-resistant version.
• Standby Flight Instruments: This unit is a "mini" primary flight display. It combines all necessary flight-relevant information including standby horizon, speed, altitude, and heading indications. This unit also includes an automatic back-up battery power supply.

To reduce aircraft downtime the "MD-11 Modification Plus" program is being coordinated with the MPET-covered insulation blanket replacement program as required in accordance with FAA AD 2000-11-02.

All modifications have been approved by the appropriate airworthiness authorities and as of January 2003, nine MD-11s previously owned by Swissair, have been modified in accordance with the "MD-11 Modification Plus" program.

4.1.5.5 United States National Transportation Safety Board

On 4 January 2002, the NTSB released five recommendations (A01-83 through A01-87) dealing with recent in-flight fires. Although not directly related to the circumstances of the SR 111 accident, NTSB's efforts reflect a common concern with the provisions currently in place for in-flight firefighting. That is, the TSB recommendations took a systems approach in identifying deficiencies in such areas as detection and suppression, crew coordination, checklist procedures, equipment, and accessibility. The NTSB recommendations focused primarily on deficiencies associated with the actions of aircraft crews in dealing with in-flight fires. The NTSB recommendations complement those of the TSB by highlighting inadequacies in aircraft crew awareness and training that limit their ability to execute effective in-flight firefighting.

4.1.6 Overhead aisle and emergency lights

4.1.6.1 Transportation Safety Board of Canada

The interest in the MD-11 aisle and emergency light assemblies stems from analysis of heat-damaged ceiling panels recovered from the SR 111 aircraft. This damage was associated with overheating of the light assembly. During subsequent aircraft inspections, conducted as part of the SR 111 investigation, the TSB became aware of additional examples of overheating conditions in the overhead aisle and emergency light fixture used on the MD-11. Subsequently, on 29 December 2000 the TSB issued ASIL (A000062-1 and A000062-2), which detailed this information to both the NTSB and the manufacturer of the fixture.

See the supporting technical information on this topic.

4.1.6.2 United States Federal Aviation Administration

The FAA reviewed the MD-11 industry in-service data pertaining to the overhead aisle and emergency lights, and determined that there was insufficient information to confirm the existence of an unsafe condition that would warrant safety action.

4.1.6.3 The Boeing Company

In response to the TSB's findings, Boeing requested that the aisle and emergency light assembly manufacturer conduct testing. The results of this testing did not reveal any anomalies and confirmed that the fixture met existing certification standards.

4.1.7 In-flight entertainment network/supplemental type certificate

4.1.7.1 Transportation Safety Board of Canada

Early in the SR 111 investigation, it was discovered that the Swissair MD-11 in-flight entertainment network (IFEN) was connected to aircraft power in such a way that was not compatible with the emergency electrical load-shedding design philosophy of the MD-11 aircraft. The IFEN was powered from AC Bus 2, a bus that is not deactivated when the CABIN BUS switch is selected. Use of the CABIN BUS switch, which was the first item in Swissair's Smoke/Fumes of Unknown Origin Checklist at the time of the occurrence, is intended to remove most electrical power from the aircraft cabin.

The TSB alerted all stakeholders of this situation while continuing to investigate the circumstances surrounding the Supplemental Type Certificate (STC) process that approved this installation.

4.1.7.2 Swissair

As a precautionary measure, on 29 October 1998, Swissair reacted to the TSB discovery by disabling the IFEN in both its MD-11 and Boeing 747 fleets. Eventually, Swissair removed the IFEN entirely.

4.1.7.3 Federal Office for Civil Aviation

On 13 November 1998, the FOCA issued FOCA Order 220.99 cancelling the validations of IFEN STC ST00236LA-D (MD-11) and ST00431LA-D (B-747).

4.1.7.4 United States Federal Aviation Administration

The FAA launched an internal Special Certification Review (SCR) of Santa Barbara Aerospace's STC ST00236LA-D, which ultimately resulted in the withdrawal of the IFEN certification. Subsequent to this review, the FAA has acted on several fronts as described in the following sections.

4.1.7.4.1 AD 99-20-08

Effective 13 October 1999, the FAA issued an AD that prevented the use of STC ST00236LA-D. The purpose of the AD was to prevent possible confusion, with respect to flight crew expectations, when performing their duties in response to a smoke/fumes emergency. Any confusion could impair their ability to correctly identify the source of the smoke/fumes and, therefore, affect the continued safe flight and landing of the aircraft.

4.1.7.4.2 Passenger entertainment system STC survey

The FAA conducted a survey of other passenger entertainment system STCs in an effort to quantify the extent of the problems identified during the SCR of STC ST00236LA-D. The survey identified unsafe conditions associated with various STCs, which resulted in the issuance of 18 ADs requiring changes to various passenger entertainment system design types. An extensive review revealed that these systems could remain powered despite flight crew procedures. Typically, these ADs required that operators deactivate or modify the entertainment system, revise crew procedures for removing power from the system, or remove the entertainment system from the aircraft entirely.

4.1.7.4.3 Aircraft certification service policy change

Based on the FAA SCR issued 14 June 1999, the FAA implemented the following corrective actions:

1. A memorandum entitled "Follow-on Corrective Actions Pertaining to Aircraft Certification Systems Evaluation Program Findings at Delegated Facilities," dated 2 July 1999. The memorandum
   • reminded all Aircraft Certification Offices (ACO) to adhere to procedures that ensure Aircraft Certification Systems Evaluation Program (ACSEP) findings that require corrective action are addressed by the managing ACO; and
   • directed the ACOs to immediately implement the intent of Draft Order 8100.XX (Designated Alteration Station (DAS), Delegation Option Authorization (DOA)), and Special Federal Aviation Regulation (SFAR) 36 Authorization Procedures), as well as Notice 8100.13, "The ACSEP Criteria for Delegated Facilities."^{Footnote 122}
2. A memorandum entitled "AIR-100 Policy Memorandum # 00-01, Proper DAS Program Notification (Letter of Intent) Content and FAA Response," dated 10 March 2000. The memorandum
   • prescribed a policy addressing what should be contained in DAS-submitted program notifications and ACO response guidelines; and
   • ensured that the DAS program notification and ACO response is standardized.
3. A memorandum entitled "AIR-100 Policy Memorandum # 00-02, Designated Alteration Station Certification Activities Performed on Foreign-Registered Test Articles, and/or at Off-Site Locations," dated 13 March 2000. The memorandum
   • prescribed a policy addressing foreign-registered test articles and off-site activities of the DASs, including activities in other countries;
   • addressed a DAS providing certification services without performing actual engineering design or installation work;
   • stated that the DASs must specify who will perform the design and installation work, and the scope of each party's involvement; and
   • required a description of how the DAS will manage the other parties' activities to ensure that all certification requirements, including those performed at a location other than the DAS's, are met.
4. A memorandum entitled "Interim Policy Guidance for Certification of In-Flight Entertainment Systems on Title 14 CFR Part 25 Aircraft," dated 18 September 2000. The memorandum provided information to FAA personnel resulting from the SCR of STC ST00236LA-D and a review of in-flight entertainment (IFE) systems certified by the STCs that
   • ensured a standardized approach to IFE system certification across all ACOs and DASs;
   • highlighted several unsafe conditions discovered during the STC reviews;
   • listed certification guidelines to prevent similar designs from obtaining FAA approval such as the following:
     • The IFE system should not be connected to an electrical bus that also supplies electrical power to systems that are necessary for continued safe flight and landing;
     • A means should be provided to remove power from the IFE;
     • CBs should not be used as a sole means to remove power from the system;
     • IFE wiring must be protected by appropriately rated and coordinated CBs;
     • Design and installation of an IFE should minimize any impact on aircraft operation; and
     • The STC applicant is accountable for certification of the entire IFE system, including the seat-mounted equipment.

Additional points resulting from the STC review included

• insufficient certification data;
• inadequate or missing requirements for maintaining IFE system separation from other systems;
• failure to produce Instructions for Continued Airworthiness;
• inadequate consideration for aircraft manufacturer's design philosophy; and
• failure to prepare an adequate electrical load analysis.

4.1.7.4.4 DDS program

Initiated in 1997, the FAA's DAS, the DOA, and SFAR 36 (DDS) Program satisfied the requirement to establish standard procedures, guidance, and limitations of authority for organizations (the DAS, DOA holder, and SFAR 36 holder) that the FAA appointed to act on its behalf. Prior to this initiative, the FAA had no directives that dealt with such delegations to organizations.

The first step in establishing this program was to draft an FAA order guiding the organizations and providing a common understanding of their authorized functions and the procedures they should follow when exercising their authority.

Expected outcomes of this program include the following:

• Standardized election, appointment, and management procedures;
• Certification processes that result in compliance with all regulations and FAA directives;
• The understanding that a Memorandum of Understanding between an organization and the FAA is a prerequisite to appointment;
• The program notification letter, formerly known as a Letter of Intent, should include both certification and conformity plans;
• Increased FAA supervision of delegated organizations;
• Increased project oversight;
• Additional training requirements for the delegation;
• Self-evaluations by delegations; and
• The standardization, in both format and content, of the DDS procedures manual.

4.1.7.4.5 Organizational designation authorization

Supplemental to the DDS program, the FAA intends to consolidate all of its delegation authorization, applicable to organizations, into a single FAR Part 183. This consolidation would terminate DAS, DOA, and SFAR 36 authorizations. The focus of the Organizational Designation Authorization (ODA) will be on system processes and an organizational model, and not on individual staff members. The FAA will approve the ODA administrator, organizational model, and procedures manual. The goal is to prohibit eligibility of applicants that have little or no experience with FAA certification procedures.

4.1.7.4.6 Policy statement ANM-01-04

The FAA released a notification entitled "System Wiring Policy for Certification of Part 25 Airplanes" on 2 July 2001. The notice announced the FAA's policy with respect to the type design data needed for the certification of wiring installed on transport category aircraft. The FAA stated that the policy is necessary to correct deficiencies associated with the submission of design data and instructions for continuing airworthiness involving aeroplane system wiring for type design, amended design, and supplemental design changes. The policy advised applicants for type certificates, amended type certificates, STCs, or type design changes of the range and quality of type design data considered acceptable to the FAA, as part of any certification project submission. The policy does not establish any new rules, but provides the applicant with advisory material on how existing rules (currently contained in 14 CFR, Part 21) are to be interpreted.

4.1.7.5 The Boeing Company

Boeing, as a supplier of factory-installed IFE systems, conducted a design review of its installations to confirm that no unsafe conditions existed. The review resulted in production changes (to several aircraft models) designed to isolate the IFE system from the cockpit.

4.1.8 Circuit breaker reset philosophy

4.1.8.1 General

As the SR 111 investigation progressed, it became evident that CB reset philosophies for the pilot, cabin crew, and maintenance communities were inconsistent across the aviation industry. A lack of a single approach created widely different interpretations regarding the best course of action in this regard.

4.1.8.2 Airbus

Airbus issued CB reset policies that do not allow CB reset in flight except in emergency conditions, and then only when authorized by the pilot-in-command.

4.1.8.3 The Boeing Company

Boeing issued essentially the same policy as Airbus, except that it stipulated that no resets for fuel pump circuits were to be carried out under any circumstances.

4.1.8.4 Transport Canada

In an effort to raise awareness on several issues surrounding the use of CBs, TC published an article in the 1/2001 issue of its Aviation Safety Letter.

4.1.8.5 United States Federal Aviation Administration

On 21 August 2000, the FAA issued a Joint Flight Standards Information Bulletin for Airworthiness, Air Transportation, and General Aviation (Flight Standards Information Bulletin for Air Transportation 00-07A) to summarize the FAA's position on the issue of resetting tripped CBs. The overriding message is one of caution. In-flight resets are not allowed unless such action is consistent with the approved Flight Crew Operating Manual and is deemed necessary for safe flight and landing. A logbook entry is necessary to provide effective troubleshooting and corrective action by maintenance crews on the ground. Additionally, CB resets on the ground are only permitted after maintenance staff have determined the cause of the trip.

4.1.8.6 Swissair

Swissair issued an AOM Bulletin (93/99) advising its MD-11 flight crews about a revision to CB reset procedures. The decision was made to allow a single reset during aircraft preparation prior to the aircraft moving under its own power. However, aircrews are not authorized to reset a tripped CB during taxi or in flight. The procedure to reboot a computer by cycling a CB, when stipulated by the manufacturer, will continue.

SR Technics, Swissair's maintenance provider, also reviewed its CB reset policy. Subsequently, the maintenance provider released Continuation Training Letter 041, which states that SR Technics expects that its technicians will use all available troubleshooting techniques to determine the cause of the electrical overload before any attempt is made to reset the CB. Additionally, SR Technics requires that all CB trips and resets are to be recorded as part of the maintenance log.

4.1.9 Standby instrumentation

4.1.9.1 Transportation Safety Board of Canada

The investigation revealed that, as the SR 111 emergency progressed, various systems-related failures occurred that affected primary instrument displays and that standby instruments were being used. Given the substantially increased pilot workload during the emergency, the investigation became interested in the adequacy of the standby instrumentation. The results of TSB's inquiry indicated that when pilots have been forced to rely on standby instruments in emergency situations, they have noted deficiencies, including poor instrument location, small displays, difficulty in transition from primary flight instruments, and lack of adequate training.

It was determined that, while the Swissair MD-11 standby instruments meet regulatory requirements, their functionality may not be optimized. Limitations with respect to location, powering, and pilot training resulted in the TSB issuing two ASAs (A010042-1 and A010042-2) on 28 September 2001. The advisories suggested that authorities consider reviewing the existing requirements for standby instrumentation, including related issues such as standby communication and navigation capabilities. The advisories also called for a review of present regulations and practices to ensure that flight crews receive adequate training in the use of standby flight instruments and that design standards be adequate to ensure that standby instruments are grouped adjacent to one another, and have a layout similar to the primary flight instruments.

See the supporting technical information on this topic.

4.1.9.2 Swissair

As part of its "MD-11 Modification Plus" program, Swissair chose to install a secondary flight display system that has a layout similar to the primary flight display in the MD-11 aircraft. The display system includes attitude, airspeed, altitude, and heading in a single integrated display. In addition, in the event of a loss of primary aircraft electrical power to the unit, the display has an auxiliary battery that can supply power for a minimum of 45 minutes.

4.1.9.3 United States Federal Aviation Administration

The FAA plans to address the emergency instrumentation issues raised by the TSB at the appropriate Aviation Rulemaking Advisory Committee (ARAC). This forum will compare the issues raised by the TSB with current safety issues and will decide upon a course of action.

4.1.9.4 The Boeing Company

Boeing advises that they have reviewed their current standby instrumentation equipment in an effort to identify any areas that could be optimized. As part of its ongoing product improvement effort to its customers, Boeing offers standby instrument systems, such as their Integrated Standby Instrument System used on the B-717, that combine several standby instrumentation requirements in a single display.

4.1.10 Material flammability standards

4.1.10.1 Transportation Safety Board of Canada

The investigation's continued research into material flammability standards has revealed several safety deficiencies that pose unacceptable risks to the flying public. On 28 August 2001, the TSB issued ASRs (A01-02 through A01-04) detailing its concerns regarding inadequacies that exist with respect to flammability standards for certain materials; testing and certification of aircraft wiring; and the requirements when conducting system safety analyses, which should also include the analysis of potential system failures that could be created by on-board fires.

The TSB believes that the use of a material, regardless of its location, type, or quantity that sustains or propagates fire when subjected to realistic ignition scenarios, constitutes an unacceptable risk, and that, as a minimum, material used in the manufacture of any aeronautical product should not propagate or sustain a fire in any realistic operating environment. Therefore, the TSB made the following recommendation:

For the pressurized portion of an aircraft, flammability standards for material used in the manufacture of any aeronautical product be revised, based on realistic ignition scenarios, to prevent the use of any material that sustains or propagates fire.
TSB Recommendation A01-02 (issued 28 August 2001)

Regardless of efforts to design, install, and maintain an aircraft's wiring system to a high standard, deficiencies with wires will likely persist and present the potential for wire failures. While all wires will arc under certain circumstances, the dynamics of how a particular wire fails during an arcing event is highly dependent on the composition of the wire insulation. Understanding the dynamics of how a wire will fail under realistic conditions would be valuable, given the known consequences of the failure of an energized wire. While the FAA endorses several failure tests (e.g., the dry arc-tracking test procedure), it does not require any failure tests as a basis for wire certification.

Therefore, given the incidence of aircraft wire failures and their role as potential ignition sources, the absence of a certification requirement that measures a wire's failure characteristics, and that specifies performance standards under realistic operating conditions, constitutes a risk. Therefore, the TSB made the following recommendation:

A certification test regime be mandated that evaluates aircraft electrical wire failure characteristics under realistic operating conditions and against specified performance criteria, with the goal of mitigating the risk of ignition.
TSB Recommendation A01-03 (issued 28 August 2001)

All aircraft systems are subject to a system safety analysis as part of their certification process. Notwithstanding, for most systems this analysis does not ascertain how the system will perform in a fire-in-progress situation. Systems, such as oxygen, conditioned air, and hydraulic systems can exacerbate such a situation. The TSB believes that a fire-induced material failure in some aircraft systems has the potential to augment the combustion process and exacerbate the consequences of an in-flight fire. Therefore, the TSB made the following recommendation:

As a prerequisite to certification, all aircraft systems in the pressurized portion of an aircraft, including their sub-systems, components, and connections, be evaluated to ensure that those systems whose failure could exacerbate a fire in progress are designed to mitigate the risk of fire-induced failures.
TSB Recommendation A01-04 (issued 28 August 2001)

See the supporting technical information on this topic.

4.1.10.2 Transport Canada

TC agrees with the TSB's recommendations and agrees that more must be done to ensure appropriate regulations with respect to material flammability standards. TC intends to coordinate its actions with both the FAA and JAA in order to harmonize their respective regulatory environments.

4.1.10.3 United States Federal Aviation Administration

The FAA agrees with the thrust of the TSB's recommendations that material flammability standards must be improved. The FAA is confident that its previously announced Flammability of Materials in Inaccessible Areas and Improved Flammability Requirements for Thermal/Acoustic Insulation programs, in addition to its Test Methods for Evaluation of Low Heat Release Materials program, will address the concerns raised in TSB Recommendation A01-02.

With respect to the issue raised in A01-03, the FAA feels the arc fault circuit breaker (AFCB) program enhances the protection of aircraft wiring. In addition, the FAA has given the Wire Systems Harmonization Working Group the task of revising the standards for wiring performance and test requirements. The FAA advises that this effort may result in the development of a technical standard order for wiring. This group is also reviewing FAR 25.1309 in order to develop recommendations for the new Wire Systems Rule to address potential wire failures and in-service conditions.

Finally, the FAA believes that the existing regulations dealing with fire protection and prevention of critical systems (e.g., oxygen) are sufficient to deal with the system fire-hardening concerns raised in A01-04. The FAA's position is that current regulations, coupled with the results of FAA initiatives, such as the AFCB program, will mitigate the risks of fire-induced failures.

4.1.10.4 The Boeing Company

On 18 May 2001, Boeing issued SB MD11-35-021 entitled "OXYGEN - Control and Distribution - Modify Crew Oxygen Supply Line Installation." The purpose of the SB was to inform MD-11 operators of an FAA-approved modification procedure that replaces the aluminium components of the crew oxygen supply line system with steel components as a fire-hardening measure.

4.1.11 Air traffic controller training

4.1.11.1 Transportation Safety Board of Canada

The investigation found that two air traffic controllers involved in this occurrence believed that flight crews, for safety reasons, might turn off some aircraft electrical and radio systems during fuel dumping operations. This perception was used by the air traffic controllers to explain the cessation of radio communications and secondary radar information, which occurred immediately after the SR 111 flight crew had indicated that they were starting to dump fuel.

In emergency situations, the potential to minimize undesirable outcomes and enhance the service provided to flight crews could depend, in part, on the controller's awareness of the ramifications of special or emergency procedures conducted by those flight crews. Controller knowledge of flight crew expectations, and basic familiarity with the capabilities of commercial aircraft, could enhance their awareness of flight crews' operational needs.

Currently, there is no regulatory requirement for controllers in Canada to receive special training in the handling of aircraft emergencies, either during ab initio or refresher training.

Consequently, on 14 August 2001, the TSB issued an ASA (A010020-1) to TC suggesting that it review controller training requirements. Consideration should be given to the need for additional training regarding aircraft emergency scenarios prior to the initial issuance of a licence to air traffic controllers under the Canadian Aviation Regulations (CARs). Specifically, further training may be warranted that provides the requisite knowledge and skills so that controllers are better able to provide safe and expeditious air traffic control (ATC) services to aircraft experiencing emergency or distress conditions. The need for regular continuation training and refresher exercises regarding emergency scenarios should also be considered.

4.1.11.2 Transport Canada

TC advised the TSB that it was liaising with the ATC service providers, Nav Canada and SERCO Aviation Services, to ensure the concerns noted in the TSB ASA are addressed.

4.1.11.3 Nav Canada

Nav Canada developed and delivered a refresher training module during 1999–2000 and 2000–2001 training years for controllers, which included familiarization with an in-flight smoke or fire emergency. The training familiarized the controllers with the expectations and operational needs of pilots, and the capabilities of a commercial aircraft, during such an emergency situation.

In addition, on 11 July 2002, Nav Canada issued an amendment to its Air Traffic Control Manual of Operations to provide controllers with new direction regarding fuel dumping operations and, in particular, the following information. "It has been determined some aircraft may be incapable of making radio transmissions during a fuel dump however, all are capable of maintaining a listening watch on the frequency. As well, some aircraft must also turn off their transponders during the fuel dump procedure."

4.2 Action required

4.2.1 Thermal acoustic insulation materials

4.2.1.1 Other thermal acoustic insulation materials at risk

Since the beginning of this investigation, the aviation industry's understanding of the flammability characteristics of thermal acoustic insulation materials has advanced considerably. The recognition that MPET-covered insulation blankets are flammable and provided the main source of fuel in the SR 111 in-flight fire was significant. Extensive flammability testing determined that such blankets are susceptible to being ignited by small ignition sources, such as electrical arcing or sparking and will propagate a fire. Consequently, the FAA required that these blankets be removed from US-registered aircraft, and accelerated work to develop an improved flammability test for the certification of all thermal acoustic insulation materials.

Occurrence data confirms that some thermal acoustic insulation materials, other than MPET-covered insulation blankets, have been involved in aircraft fires that were ignited by electrical sources. FAA research revealed that these other thermal acoustic insulation materials, although more difficult to ignite, exhibit similar flammability characteristics once ignited. The flammability test that was used to certify all such materials (i.e., the vertical Bunsen burner test) was designed to determine whether the material would ignite from a small ignition source, such as an electrical arcing event, and extinguish within a predetermined flame time and burn length. All such materials were approved for use in aircraft because, once ignited, they self-extinguished within a predetermined flame time and burn length. The FAA's Radiant Panel Test (RPT) certifies materials using similar, albeit much more stringent, criteria.

The FAA has tested a representative sample of thermal acoustic insulation materials currently in use in the aviation industry and has determined that approximately two-thirds failed the RPT. Because the RPT effectively fails materials that could be ignited from a small ignition source, including an arc or spark, then potentially, these failed materials could exhibit such inappropriate characteristics while in-service. If the RPT is ultimately approved, any materials that fail the RPT would not be acceptable for use in any future aircraft manufacture or repair. However, unlike the case with MPET-covered insulation blankets, there is no indication that regulatory authorities will mandate a wholesale removal, from existing aircraft, of those other in-service thermal acoustic insulation materials that failed the RPT.

Additionally, since smoke generation and toxicity limits have never been established for thermal acoustic insulation materials, the associated risks have not been quantified. Such risks would likely be a factor if these flammable materials become involved in an in-flight fire. It has been suggested that, once the RPT is adopted, the "zero burn" feature of the RPT will result in the eventual elimination of flammable thermal acoustic insulation material in aircraft, and therefore, measuring a material's smoke generation and toxicity levels, as part of the certification process, is unnecessary. However, under the present approach, mitigation of the risks associated with these flammable materials will not be accomplished until the existing fleet of aircraft is replaced. Therefore, known flammable materials will exist for decades in thousands of aircraft worldwide.

The in-flight fire risks associated with MPET-covered insulation blankets have largely been mitigated. However, there are other thermal acoustic insulation materials that once ignited, exhibit similar flammability characteristics to MPET-covered insulation blankets, and have failed the RPT. Although these materials exist in many aircraft, as of this report's publication date, no mitigation strategy has been undertaken to address the known associated risks. Therefore, the Board recommends that:

Regulatory authorities quantify and mitigate the risks associated with in-service thermal acoustic insulation materials that have failed the Radiant Panel Test.
Transportation Safety Recommendation A03-01

4.2.1.2 Proposed certification standard for thermal acoustic insulation materials

The FAA has proposed a rule that would replace the existing vertical Bunsen burner test with the RPT to evaluate fire ignition and propagation characteristics of all thermal acoustic insulation materials. During its validation of the RPT, the FAA reported that only 25 to 35 per cent of the various insulation blanket cover materials would pass the RPT. The proposed test has been widely accepted as a major improvement over the previous test in that it effectively imposes a "zero burn" criterion for all thermal acoustic insulation materials. Although the test would be required for all thermal acoustic insulation materials, and appears to be a better discriminator of materials that exhibit inappropriate flammability characteristics, the design of the RPT contains some inherent limitations.

The RPT is designed to expose the test specimen to a small fire-in-progress scenario that sets higher ignition and propagation threshold "pass" requirements. However, there are concerns about whether the current RPT suitably addresses the following key issues:

• Although the FAA believes that a test specimen's orientation is an important factor in determining its propensity to be ignited and propagate a fire, the RPT only requires that a specimen be oriented horizontally;
• The RPT has its origins in the American Society for Testing and Materials E648 test, which requires that the test specimen be pre-heated prior to the application of the flame. Although the FAA recognizes the benefits of pre-heating test specimens because of the deleterious effects on the thin-film covered thermal acoustic insulation materials, the RPT does not impose this pre-heat condition; and
• The RPT requires the testing of three specimens that include all those materials used in the construction of insulation blankets (including batting, film, scrim, tape, etc.). However, it does not indicate how the flammability characteristics of the component materials are to be tested in the various permutations and combinations while only requiring that three specimens be tested.

Also, the Board is aware of initiatives by the FAA to design the RPT to account for potential degradation in the flammability characteristics of materials after they are exposed to their intended operating environment. The FAA has recognized that most aircraft in-service have insulation blankets with varying degrees of surface contamination, and that experience has shown that such contamination cannot be fully avoided. Therefore, one goal of the testing is to develop an appropriate evaluation procedure that can account for realistic in-service conditions.

Because the issues listed above are not addressed, it is unclear how the RPT would effectively identify all thermal acoustic insulation materials that may exhibit inappropriate flammability characteristics. Rather, it appears that the RPT is a single certification test for thermal acoustic insulation materials, which under certain conditions (such as conditions that do not involve pre-heating), results in an effective flammability test for thin-film-covered insulation blanket materials.

By developing the RPT, the FAA has successfully designed a single certification test that, while a major improvement over the vertical Bunsen burner test, may not successfully evaluate the performance of all types of thermal acoustic insulation materials under representative conditions. Given these limitations of the FAA's proposed RPT, the Board recommends that:

Regulatory authorities develop a test regime that will effectively prevent the certification of any thermal acoustic insulation materials that, based on realistic ignition scenarios, would sustain or propagate a fire.
Transportation Safety Recommendation A03-02

4.2.2 Interpretation of material flammability test requirements

As a result of the investigation, the TSB previously issued three recommendations on the subject of Material Flammability Standards. Reaction to the content of these recommendations has been positive. Regulatory authorities have largely embraced the need for regulatory changes that would result in no materials being certified that would sustain or propagate a fire, as recommended in A01-02. The FAA is leading a research and development effort as part of the International Aircraft Materials Fire Test Working Group that is developing new flammability tests for materials, including wires and cables, found in "hidden areas." The Board believes that imposing more realistic and thus more severe flammability test requirements will serve to decrease the likelihood of flammable materials being approved for use in the manufacture or repair of aircraft. However, variations still remain in the interpretation and application of the regulations and guidance material.

Throughout this investigation, in an effort to determine the ignition and propagation scenario for the in-flight fire, various materials used in the manufacture of the MD-11 were tested in accordance with the applicable regulatory requirements. In some cases, materials such as silicone elastomeric end caps and hook-and-loop fasteners, demonstrated inappropriate flammability characteristics. Neither the aircraft manufacturer nor the regulatory authority were able to effectively explain whether these or other such materials had been required to be tested and, if so, could not produce a record of the resultant certification test data. It appears that varying interpretations of the same regulations may explain why some materials that were certified for use in aircraft met the flammability standards while others did not. As explained in the TSB's Material Flammability Standards recommendation package (issued August 2001), except for the most obvious and common materials, it was difficult to determine with certainty which flammability test(s) applied to which material. The applicable FARs could be misinterpreted so as to minimize the amount and level of testing required for certification of any particular material.

The certification of a newly manufactured aircraft is a complex endeavour, which includes the certification of many types of materials. The Board expected that as a result of its previous recommendations, regulatory authorities would not only develop improved testing but also simplify the interpretation of the regulations and guidance material so as to prevent the approval of flammable materials. Without such a concerted and focused effort, manufacturers and those responsible for the certification of aircraft materials will continue to operate in an environment where it is possible to misinterpret the regulatory requirements. In such circumstances, materials that exhibit inappropriate flammability characteristics can continue to be approved for use in aircraft. Therefore, the Board recommends that

Regulatory authorities take action to ensure the accurate and consistent interpretation of the regulations governing material flammability requirements for aircraft materials so as to prevent the use of any material with inappropriate flammability characteristics.
Transportation Safety Recommendation MA03-03

4.2.3 IFEN – Supplemental type certificate process

Based on information highlighted by this accident, the FAA has initiated many positive changes to its type certification process. However, there is one area that the Board feels requires additional consideration.

The purpose of FAR 25.1309 is to confirm that a system's design does not adversely affect the original aircraft type certificate. This investigation identified a deficiency with the provisions of FAR 25.1309, which allowed the IFEN STC ST00236LA-D system-to-aircraft integration design to be approved without confirmation that it was compliant with the aircraft's original type certificate. The Board is aware that there were other STC designs, certified in accordance with FAR 25.1309, in which the system-to-aircraft integration design introduced latent unsafe conditions with the potential to adversely impact the operation of the aircraft during emergency procedures. In some instances, the STC process allowed the intended function of certain checklist procedures during abnormal or emergency situations, to be altered without issuing an Airplane Flight Manual (AFM) supplement to advise the pilots. Although FAR 25.1309 applies to all aircraft systems, it would appear that STC designs that have been typically viewed as "non-essential, non-required"and that can be approved based on a qualitative assessment, are especially susceptible to improper integration.

The Board believes that, as currently written, FAR 25.1309 can be interpreted to allow STC approval of system-to-aircraft integration designs that are not compliant with the original type certification. Therefore, the Board recommends that:

Regulatory authorities require that every system installed through the STC process, undergo a level of quantitative analysis to ensure that it is properly integrated with aircraft type-certified procedures, such as emergency load-shedding.
Transportation Safety Recommendation A03-04

4.2.4 Circuit breaker reset philosophy

In recent years, aircraft manufacturers and operators have identified improper CB reset procedures. Consequently, they have taken positive steps to determine the most appropriate philosophy governing the resetting of CBs and to communicate that philosophy to pilots and technicians. The FAA 's Flight Standards Information Bulletin has also served to normalize the approach to the resetting of CBs taken by operators and their personnel, specifically flight crews, maintenance personnel, and ground servicing personnel.

TC relayed its position on the resetting of CBs in an issue of the Aviation Safety Letter, whose distribution is limited to Canadian licensed pilots. Awareness about such "best practices" appears to be increasing; however, the regulatory environment remains unchanged. At this time, requirements and guidance material do not include a clear and unambiguous message stipulating the acceptable CB reset philosophy, and the consequences of an inappropriate CB reset.

The Board believes that despite these initiatives, if the existing regulatory environment is not amended to reflect the acceptable CB reset philosophy, such "best practices" will not be universally applied across the aviation industry and ultimately, the positive changes currently established may not be maintained. Therefore, the Board recommends that

Regulatory authorities establish the requirements and industry standard for circuit breaker resetting.
Transportation Safety Recommendation A03-05

4.2.5 Accident investigation issues

4.2.5.1 Quality of CVR recording

Frequently, the CVR recording of cockpit conversations are of poor quality, particularly when the conversations are recorded through the CAM. The voice quality on CVR recordings is dramatically improved when voices are recorded through boom microphones. However, pilots are not required to wear headsets with boom microphones at cruising altitudes.

Various national regulations differ concerning the maximum altitudes below which flight crews are required to wear boom microphones. For example, the CARs require the use of boom microphones below 10 000 feet, the FARs below 18 000 feet and the Joint Aviation Requirements do not have any requirement that they be used. Swissair required their pilots to use boom microphones when flying below 15 000 feet. The present requirements were developed before modern technology allowed headsets with boom microphones to be designed for comfort over long periods of time, such as during cruise flight.

When the SR 111 pilots first noted an odour in the cockpit, they were in cruise flight and were not wearing boom microphones. Although the internal communications between the pilots were recorded through the CAM, the conversations were difficult to hear and decipher. There was a marked improvement in recording quality after the pilots donned their oxygen masks, which have built-in microphones.

Even though the boom or oxygen mask microphones are recorded on a different channel than the CAM, the recordings of internal communications on the microphone channels are still frequently masked by incoming radio transmissions because internal, as well as external, communications are recorded on the same CVR channels but at different amplitudes. For example, the recorded incoming radio communications for SR 111 were of significantly higher amplitude than the internal communication from the mask microphone, making it difficult and occasionally impossible to discern internal communications. The relative amplitude of the incoming radio calls to that of the internal communications is pre-set at equipment installation and is not affected by crew adjustment of audio volume. Therefore, even if the pilots can hear each other readily through their headsets, the CVR recording of internal communications may be masked substantially by incoming radio communications. Significant difficulties in extracting such "masked" internal communications from CVR recordings have been experienced by the TSB and by safety investigation agencies from other nations.

The ability to decipher internal conversations between flight crew members is an important element of effective accident investigation. Therefore, the Board recommends that

Regulatory authorities, in concert with the aviation industry, take measures to enhance the quality and intelligibility of CVR recordings.
Transportation Safety Recommendation A03-06

4.2.5.2 Quick access recorder data

Quick access recorders (QAR) are voluntarily installed in many transport aircraft and routinely record far more data than the mandatory FDR. For example, the FDR installed on SR 111 was a solid state unit that recorded approximately 250 parameters, whereas the QAR used a tape-based cartridge, which recorded approximately 1 500 parameters. That is, the optional QAR recorded six times the amount of data recorded on the mandatory FDR. The additional data recorded on the QAR included numerous inputs from line replaceable units (LRU) that would have been extremely valuable in determining aircraft systems status, as well as temperatures at a number of locations in the fire-damaged area.

Many airlines are developing Flight Operational Quality Assurance (FOQA) or Flight Data Monitoring (FDM) programs; such programs require that increased data sets be recorded. The use of QARs is voluntary; therefore, the operating environment allows operators to change the QAR data-set according to their operational requirements. Conversely, changing the data-set on an FDR is currently an expensive process, largely due to the associated re-certification issues. As modern-day versions of both types of recorders employ solid state memory technologies, these modern FDRs effectively have as much capacity to record data as QARs. The Board believes that there is no technical reason why safety investigations should not benefit from the FOQA/FDM trend, and that all data voluntarily collected for any operational purpose should also be available for accident investigation. To achieve this, regulatory authorities need to develop regulations that protect the core parameters required for all FDRs, while also allowing FDRs to be easily augmented with additional parameters, higher sample rates, and higher resolutions without requiring re-certification of the FDR and without requiring validation/calibration of parameters that are not dedicated to the FDR. Operators would need ready access to these FOQA/FDM parameters and might choose to use only the FDR unit to meet the mandatory FDR parameter list, as well as their optional FOQA/FDM data needs.

The Board recognizes that the US convened a Future Flight Data Collection Committee to address these issues, and that in Europe, the European Organisation for Civil Aviation Equipment (EUROCAE) Working Group 50 is updating its international Minimum Operational Performance Specifications. The Board supports FOQA and FDM programs and believes that they contribute significantly toward improving aviation safety. The Board also believes that all FOQA and FDM data routinely collected should be available for safety investigations. Therefore, the Board recommends that:

Regulatory authorities require, for all aircraft manufactured after 1 January 2007 which require an FDR, that in addition to the existing minimum mandatory parameter lists for FDRs, all optional flight data collected for non-mandatory programs such as FOQA/FDM, be recorded on the FDR.
Transportation Safety Recommendation A03-07

4.2.5.3 Image (video) recording

Only recently has it become economically feasible to record cockpit images in a crash-protected memory device. New "immersive" technology provides for camera systems that can capture panoramic, wide-angle views necessary to record the cockpit environment. Image recordings can capture other aspects of the cockpit environment that would otherwise be impractical or impossible to record. Special playback software allows investigators to "immerse" themselves in the cockpit and view virtually the entire flight deck.

Vital information regarding the cockpit environment, non-verbal crew communications, crew workload, instrument display selections and status have not been available on traditional data and voice recorders. This has limited the scope of many investigations, but more importantly, has hindered the identification of safety issues and consequently the corrective action needed to prevent future occurrences.

Some operators are installing video cameras for operational purposes. These systems provide the flight crew with images, such as the external views of the undercarriage area, wings and engines, or internal views of cargo and cabin areas. Since these video images have the potential to influence critical operational decisions, the images presented to the flight crew should be stored in crash-protected memory to facilitate safety investigations.

The Board believes that image recording in the cockpit will substantially benefit safety investigations. It will provide investigators with a reliable and objective means of expeditiously determining what happened. This will assist safety investigators in focusing on why events took the course they did, what risks exist in the system, and how best to eliminate those risks in the future.

The Board endorses the NTSB recommendations issued in April 2000 (A-00-30 and A-00-31), and advocates the development of international Minimum Operational Performance Specifications for image recording systems by EUROCAE Working Group 50. Therefore, the Board recommends that:

Regulatory authorities develop harmonized requirements to fit aircraft with image recording systems that would include imaging within the cockpit.
Transportation Safety Recommendation A03-08

The Board is acutely aware of the concerns expressed by industry associations that sensitive recordings will be inappropriately released to the public or used for purposes other than safety investigation. While Canada treats these recordings as privileged, all nations do not. If image recordings are to be universally accepted, worldwide protections need to be put in place for all cockpit voice and image recordings. These protections would allow investigation authorities to use the recordings for safety purposes while preventing them from being aired for other purposes. Therefore, the Board recommends that:

Regulatory authorities harmonize international rules and processes for the protection of cockpit voice and image recordings used for safety investigations.
Transportation Safety Recommendation A03-09

4.3 Safety concern

4.3.1 In-flight firefighting measures

In December 2000, the TSB issued five recommendations that identified deficiencies associated with in-flight firefighting measures. Although the Board recognizes that improved material flammability certification tests will eventually result in a decreased threat, flammable materials will remain in many aircraft for decades. In addition, initiatives aimed at reducing potential ignition sources, such as improved CB, wire inspection methods, and maintenance procedures, while encouraging, will not eliminate all potential ignition sources. Consequently, the Board believes that continuing emphasis must be placed on ensuring that aircraft crews are adequately prepared and equipped to quickly detect, analyze and suppress any in-flight fire, including those that may occur in areas such as cockpits, avionics compartments, and hidden spaces.

The Board is encouraged that the deficiencies identified in its recommendation package of December 2000 are being assessed and acted upon at various levels by manufacturers, operators, and regulatory authorities. Such activity will lead to enhanced safety, and some positive changes have already been achieved as indicated in Section 4.1 of this report. However, industry-wide progress appears to be unnecessarily slow. For example, although some airline operators have made improvements, the Board remains concerned with the pace of progress in mandating that all aircraft crews have a comprehensive firefighting plan that starts with the assumption that any smoke situation must be considered to be an out-of-control fire until proven otherwise, and that an immediate response based on that assumption is required. Regulatory authorities have not taken substantive measures to ensure that aircraft crews are provided with all necessary firefighting procedures, equipment, and training to prevent, detect, control, and suppress fires in aircraft.

In addition, there are specific aspects that remain problematic. In the recommendation package dealing with in-flight firefighting measures, the TSB expressed concern with the lack of built-in smoke/fire detection and suppression equipment in hidden areas of aircraft. For the most part, smoke/fire detection is reliant on human sensory perception, and fire suppression is dependent on direct human intervention. As shown by this accident, human sensory perception cannot be relied on to consistently detect or locate an in-flight fire. Furthermore, it is unrealistic to rely on human intervention for firefighting in areas that are not readily accessible. The Board believes that the industry, led by regulatory authorities, needs to do more to provide a higher degree of safety by enhancing smoke/fire detection and suppression capabilities.

The TSB expressed concern that there was a lack of awareness in the industry about the potential seriousness of odour and smoke events. The TSB recommended that regulatory authorities take action to ensure that industry standards reflect a philosophy that when odour/smoke from an unknown source appears in an aircraft, the most appropriate course of action is to prepare to land the aircraft expeditiously. Although the tragic events of SR 111 have served to alert the industry to the threat from in-flight fire, the Board believes that the potential for complacency may increase with the passage of time. The Board believes that regulatory authorities need to do more to enhance the regulatory environment (i.e., regulations, advisory material, etc.) to ensure that awareness remains high in the long term and appropriate plans, procedures, and training are in place industry wide.

The TSB has observed that personnel involved with maintaining and operating aircraft remain unaware of the potential existence of flammable materials in their aircraft. In general, the predominant misconception remains as it was before SR 111; that is, that the materials used in aircraft construction are "certified," and therefore are not flammable. As highlighted by this investigation, existing certification criteria do not ensure that materials used in the manufacture or repair of aircraft are not flammable. This lack of awareness continues to lead to circumstances where potential ignition sources, such as electrical anomalies, are viewed as reliability or maintenance issues, and not as potential safety issues and fire threats.

As the threat from an in-flight fire will continue to exist in many in-service aircraft, the Board believes that as a minimum, aircraft crews need to be provided with a comprehensive firefighting plan that is based on the philosophy that the presence of any unusual odour or smoke in an aircraft should be considered to be a potential fire threat until proven otherwise. The Board has yet to see significant industry-wide improvements in certain important areas, and is concerned that regulatory authorities and the aviation industry have not moved decisively to ensure that aircraft crews have adequate means to mitigate the risks posed by in-flight fire, by way of a comprehensive firefighting plan that includes procedures, equipment, and training.

4.3.2 Aircraft system evaluation: Fire-hardening considerations

In its material flammability standards recommendation package issued in August 2001, the TSB identified a deficiency regarding the certification of certain aircraft systems. In its recommendation A01-04, the TSB stated that more validation needed to be done prior to the certification of aircraft systems to ensure that a fire-induced material failure would not exacerbate the consequences of an in-flight fire. The response from the regulatory authorities supported the status quo by declaring that the regulations governing the certification of critical systems, such as hydraulic, oxygen, and flight controls were comprehensive enough to address a system's fire protection and prevention requirements. For other aircraft systems, regulatory authorities have indicated that the combined effect of increasing the material flammability standards, introducing new technologies like the AFCBs, and implementing the recommendations of the Wire Systems Harmonization Working Group will mitigate the risk of initiating or sustaining an in-flight fire.

Testing during the investigation demonstrated that the flight crew oxygen system in the MD-11 could fail in a high heat environment, and exacerbate a fire. The regulatory authorities have not addressed the issue of how the existing regulations allowed for the certification of this oxygen system, which was constructed using dissimilar metals, while providing for the "fire protection and prevention" certification requirement. The design of the oxygen system met the requirements of existing regulations, otherwise, it would not have been approved for use in an aircraft. The same holds true for other materials that failed and exacerbated the SR 111 fire, such as the silicon elastomeric end caps on the air conditioning ducts.

The Board disagrees that the eventual reduction or elimination of flammable materials, and anticipated technological advances, adequately deal with the near-term risk. Therefore, the Board is concerned that regulatory authorities have not taken sufficient action to mitigate the risks identified in the TSB's recommendation A01-04, issued in August 2001, which recommended that as a prerequisite to certification, all aircraft systems in the pressurized portion of an aircraft, including their subsystems, components, and connections, be evaluated to ensure that those systems whose failure could exacerbate a fire-in-progress are designed to mitigate the risk of fire-induced failures.

4.3.3 Aircraft wiring issues

4.3.3.1 Material flammability test requirements for aircraft wiring

In one of its recommendations regarding Material Flammability Standards (A01-03), the TSB explained the need to augment the certification test regime used in the approval of aircraft wires. Specifically, the certification criteria need to be expanded to include the determination of wire failure characteristics, using realistic operating conditions and specified performance criteria. The goal of such certification requirements would be to establish standards that would prevent the approval of any wire whose in-service failure could ignite a fire and minimize further collateral wire damage.

Regulatory authorities have advised the TSB that this issue is to be dealt with under the auspices of the FAA's Aging Transport Systems Rulemaking Advisory Committee (ASTRAC). The Board is aware that a Wire Systems Harmonization Working Group has been established to review the certification standards related to aircraft wiring systems. However, in evaluating the assignments of this working group, the Board was unable to identify a specific task that would initiate a review, based on the deficiency described in A01-03.

The Board appreciates that regulatory authorities are dealing with the larger issue of in-flight fires on several fronts, including improved material flammability standards and AFCB technology. While such activities have been beneficial and necessary, the Board is concerned that the deficiency identified in its A01-03 recommendation will not be corrected unless a specific regulatory review of certification requirements is undertaken to ensure the proper evaluation of aircraft electrical wire failure characteristics.

4.3.3.2 Limitations of FAR 25.1353 electrical equipment and installations

During this investigation, the TSB found that there are limitations associated with the interpretation and application of FAR 25.1353(b). In aircraft design, it is not always possible to maintain physical separation between wires, especially in the cockpit area where, typically, space available for installations is confined. The guidance material does not specify what measures or criteria would be acceptable to meet the requirements of FAR 25.1353(b).

The Board has not issued a safety communication on this subject as it is aware that the FAA's ASTRAC (includes the JAA and TC) has been tasked with identifying the requirements for wire separation as they pertain to electrical equipment and installations. Specifically, the ASTRAC is to determine whether a comprehensive wire separation regulation needs to be included in a new wire system rule.

The ASTRAC's final recommendations on this matter have yet to be published; however, the Board is aware that Working Group 6 has declared to the FAA that the creation of separation standards is well beyond the scope of its tasking. Given this situation, it is unlikely that substantive change on the matter of wire separation will result from the current round of ASTRAC assignments. The Board remains concerned about the limitations regarding the interpretation of FAR 25.1353(b) and encourages the regulatory authorities to take follow-up action to research and resolve this matter.

4.3.3.3 Potential limitations of MIL-W-22759/16 wire

The primary wire type selected for the IFEN system installation was MIL-W-22759/16. This wire is commonly used by aircraft modifiers and the general aviation industry, although the wire is not used by major aircraft manufacturers, such as Bombardier and Boeing. The wire type is certified and used successfully without any record of inherent problems or adverse service history.

The Board is aware that on 22 March 2002, the United Kingdom Civil Aviation Authority issued Appendix 64 to its Airworthiness Notice 12, entitled Experience from Incidents. Appendix 64 deals specifically with MIL-W-22759/16 Electrical Cable and states, in part:

[P]articular care must be taken when selecting this cable type to ensure that it meets all installation requirements and is fit for its intended application.

The appendix lists several areas that must be addressed prior to the approval of MIL-W-22759/16 wire usage in the United Kingdom.

While the Board has not determined that this wire type is problematic, it remains concerned that, based on the Airworthiness Notice 12, the in-service performance of MIL-W-22759/16 wire may not be fully known.

4.3.4 Flight crew reading light (Map light)

The Board appreciates that improvements to the FCRL design and to the installations in MD-11s, have been undertaken since its ASA A000008-1 was issued. While it was appropriate that such improvements focused on the MD-11 FCRL and its installation, the Board believes that some of the same design limitations may exist in variants of this FCRL that are installed in other types of aircraft. The Board is concerned that there is not enough being done to apply the lessons learned from the deficiencies of the FCRL installation in the MD-11 to other aircraft installations involving the variants of this FCRL.

4.3.5 Standby instrumentation

The Board recognizes that TC has committed to reviewing the requirements for standby instrumentation, including related issues such as standby communication and navigation capabilities. TC has indicated that the appropriate approach would be to address these issues in harmony with the FAA and the JAA, and that this objective could be achieved through current and future ARAC activities. The Board remains concerned with the lack of substantive progress in mitigating the risks identified in the TSB ASA A010042-1 (issued 28 September 2001) and encourages TC to work with the FAA and the JAA to expedite the required safety action.

TC indicated that during the certification process, the suitability of the standby instrumentation display(s) and placement are evaluated. TC also indicated that the installation of digital integrated standby instrument systems appears to improve the displayed information. The Board believes that standby instruments should be in a standard grouping layout similar to the primary flight instruments, and that the instruments should be positioned in the normal line of vision of the flight crew. The Board encourages TC to coordinate with the FAA and the JAA to address this issue without further delay.

The Board notes that TC is reviewing training scenarios developed by airline operators. The Board believes that TC should ensure that realistic training scenarios, involving the use of standby instruments, are incorporated in training programs, and that the scenarios include complicating factors, such as loss of additional systems, wearing of oxygen masks and goggles, and smoke in the cockpit.

The Board remains concerned that regulations do not require that standby instruments are capable of remaining powered by an independent power supply that is separate from the aircraft electrical system and battery. The Board believes that with current technology, providing independent standby instrumentation for secondary navigation and communication is feasible. The Board encourages TC to coordinate with the FAA and the JAA to address this issue without further delay.

4.3.6 Contamination effects

Although the Board determined that contamination was not a factor in the initiation of the fire in SR 111, it remains concerned that the role of contamination in an in-flight fire is not well known. The Board believes that more needs to be done to quantify the risks. The Board is presently investigating the role of contamination in the context of another in-flight fire accident. TSB Investigation Report A02O0123 will address the safety deficiencies associated with contamination of aircraft.

4.3.7 Arc-fault circuit breaker certification

Significant research and development has been done in recent years to quantify and address the inherent limitations of existing aircraft CB design. This work has resulted in a new type of CB known as the AFCB, capable of reacting to a wider range of arc fault situations. The AFCB will prevent an arc fault from developing into a more serious situation that could damage other nearby wires and will limit the energy available to ignite flammable materials. While the AFCB trip characteristics will provide major improvements over the traditional aircraft CB design, these devices will not be certified to a standard that will require that the AFCB trips prior to the ignition of nearby flammable material. The Board is concerned that unless this aspect of the design specifications is addressed, AFCBs certified for use on aircraft will be capable of remaining energized long enough to ignite nearby flammable material.

4.3.8 Role of the FAA's Aircraft Evaluation Group

Title 49 United States Code section 44702(d) provides the FAA Administrator with the authority to delegate matters related to the examination, testing, and inspection necessary to issue certificates as part of its type certification process. The Administrator has determined that there exist certain aspects that are not to be delegated. One such function is the role of the FAA's Aircraft Evaluation Group (AEG), which is responsible for providing operations and maintenance input to all facets of the type certification process. For STCs, the FAA has determined that no delegate may make determinations regarding operations and maintenance issues; that role is reserved for the AEG.

For STC ST00236LA-D, the impact on the operations and maintenance of the MD-11 was determined by the STC applicant without direct AEG involvement. A survey of similar "non-essential, non-required" IFE system STCs revealed that approximately 10 per cent had been designed, installed, and certified in such a way that the flight crew could not remove electrical power from the IFE system without also interfering with essential aircraft systems. The survey results indicate that the operational review conducted as part of the STC ST00236LA-D approval process, was not unique in not detecting operational shortfalls.

The Board is concerned that a de facto delegation of the AEG's role has evolved with respect to the type certification process, which has resulted in less-than-adequate assessments of the operations and maintenance impact of some STCs, particularly those STCs designated as "non-essential, non-required."

4.3.9 Checklist modifications

Checklists are designed by aircraft manufacturers and approved by regulatory authorities as part of the original evaluation and approval of aircraft-type design data. As airline operators decide to modify checklists to meet changing operational requirements, there is a need for modified checklists to follow the original design concepts contained in the AFM or other documents associated with the certificate of airworthiness.

In the absence of regulations requiring the approval of checklists that have been modified by airline operators, guidance material should be provided to operations inspectors. The guidance material, as a minimum, should contain methods of checklist design; checklist content; checklist format utilizing human factors principles; immediate action items; and sequencing of checklist items.

The Board is concerned that, given the lack of checklist modification and approval standardization within the aviation industry, airline operators may unknowingly introduce latent unsafe conditions, particularly to emergency checklists.

4.3.10 Accident investigation issues

4.3.10.1 Flight recorder duration and power supply

TSB Recommendations A99-01 through A99-04 were sent to the Minister of Transport in Canada and to the JAA in the Netherlands. The TSB also sent copies of its recommendations to the Swiss Aircraft Accident Investigation Bureau, the United Kingdom Air Accidents Investigation Branch and the French Bureau d'Enquêtes et d'Analyse. Concurrently, the NTSB issued similar recommendations A99-16 through A99-18 to the FAA.

TC has agreed with the recommendations and advises that it is taking measures to amend its regulations by the dates stipulated by the TSB. However, TC also advises that because the FAA is dealing with similar issues raised by the NTSB, it intends to harmonize its actions with those of the FAA. In this regard, the NTSB has expressed its apprehension that, although the FAA has indicated the intention to implement the recommended actions, the dates for final action may not be met.

The Board recognizes that TC has started its consultative process with the Canadian aviation industry, and understands the value of a harmonized approach with US authorities. However, the Board is concerned that TC will also not meet its commitment to implement the required changes in a timely fashion.

4.3.10.2 Underwater locator beacon

The flight recorders were recovered from the ocean floor by tracking the acoustic waves emitted from their attached underwater locator beacon (ULB). Given the substantial fragmentation of the aircraft wreckage, and the low visibility water conditions, the ULBs minimized the time required to locate the recorders.

While the recorder's internal crash-protected memory modules were intact, the ULB brackets were damaged. The extent of the bracket damage suggests a high probability that one or both of the ULBs could have readily detached during the impact sequence. The issue of the adequacy of ULB attachments has been a concern of the international recorder community for years.

The Board recognizes that EUROCAE Working Group 50 is developing minimum operational performance specifications for crash-protection of airborne recorders. Currently, these specifications include requirements for the application of impact shock tests to ensure the integrity of a flight recorder's ULB attachment. As EUROCAE recommendations are advisory in nature, the Board is concerned that without adoption and harmonization by regulatory authorities worldwide, ULB attachment specifications may not be universally applied.

4.3.10.3 Non-volatile memory

Modern aircraft are equipped with electronic systems that contain memory devices designed for data storage. Most commonly, such systems contain a type of volatile memory device whose data is lost when power is removed. Frequently, systems contain a memory device known as non-volatile memory (NVM), which is capable of retaining its stored data even though power has been removed. In the case of SR 111, the engines were controlled with the assistance of full-authority digital electronic control (FADEC) engine control units, which contained NVM devices. In the absence of FDR information, data retrieved from the engine FADEC 2 was helpful in providing some information about the final five-and-a-half minutes of the flight. However, as the FADEC memory was designed for engine maintenance troubleshooting purposes, and the "time stamp" indicating when faults occurred versus when they were written to memory, was of poor resolution for accident investigation purposes. In addition, many other NVM devices from other LRUs were extremely difficult and time-consuming to identify as there were no distinctive markings to facilitate identification.

The Board is concerned that manufacturers and designers of equipment containing memory devices may not consider the potential use of such devices for accident investigation purposes. These aspects are best considered at the design stage, when improvements in data quantity, quality, and ease of device recognition can generally be included for relatively low cost.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized release of this report on 27 March 2003.

A

A

ampere

A&P

airframe and powerplant

AAIB

Aircraft Accident Investigation Bureau (Swiss)

AC

Advisory Circular

AC

alternating current

ACARS

aircraft communications addressing and reporting system

ACC

air conditioning controller

ACC

area control centre

ACO

Aircraft Certification Office

ACP

audio control panel

ACSEP

Aircraft Certification Systems Evaluation Program

AD

Airworthiness Directive

ADAS

auxiliary data acquisition system

ADC

air data computer

ADG

air-driven generator

ADT

Atlantic daylight time

AEG

Aircraft Evaluation Group

AEGIS

Advanced Electronic Guidance and Instrumentation System

AES

airborne earth station (within discussion of ACARS)

AES

Auger electron spectroscopy (within discussion of material analysis)

AFCB

arc fault circuit breaker

AFF

aircraft firefighting

AFM

Airplane (or Aircraft) Flight Manual

AFS

auto flight system

agl

above ground level

Al

aluminum

ALAR

Approach and Landing Accident Reduction

ALPA

Air Line Pilots Association

AMU

audio management unit

AND

aircraft nose down

ANU

aircraft nose up

AOC

Air Operator Certificate

AOL

All Operator Letter

AOM

Aircraft Operations Manual

AP

Autopilot

APU

auxiliary power unit

ARAC

Aviation Rulemaking Advisory Committee

ARINC

Aeronautical Radio Inc.

ARP

Aerospace Recommended Practice

ARSR

air route surveillance radar (USA)

ARTCC

Air Route Traffic Control Center (USA)

ASA

Aviation Safety Advisory

ASB

Alert Service Bulletin

ASC

automatic systems control

ASCP

air systems control panel

ASDE

airport surface detection equipment

ASHRAE

American Society of Heating, Refrigeration and Air Conditioning Engineers

ASIL

Aviation Safety Information Letter

asl

above sea level

ASN

assigned serial number

ASR

Aviation Safety Recommendation

ASTM

American Society for Testing and Materials

ASTRAC

Aging Transport Systems Rulemaking Advisory Committee

ATA

Air Transport Association

ATC

air traffic control

ATIS

automatic terminal information service

ATPL

airline transport pilot licence

ATS

air traffic services

AU

avionics upper [panel]

AVI

Audio-Video Interleave [Microsoft]

AWG

American Wire Gauge

B

BDN

broadband distribution network

BEA

Bureau d'Enquêtes et d'Analyses pour la Securité de l'Aviation Civile (France)

BIO

Bedford Institute of Oceanography

C

14 CFR

Title 14, Code of Federal Regulations (USA)

°C

degree(s), Celsius

CAA

civil aviation authority

CAAC

Civil Aviation Administration of China

CAC

center accessory compartment

CAD

computer-aided design

CAM

cockpit area microphone

CANMET

Canada Centre for Mineral and Energy Technology

CARAC

Canadian Aviation Regulation Advisory Council

CARs

Canadian Aviation Regulations

CASS

Continuing Analysis and Surveillance System

CAVOK

ceiling and visibility OK

CB

circuit breaker

CC

cluster controller

cc

cubic centimetre

CCA

circuit card assembly

CCG

Canadian Coast Guard

CCGS

Canadian Coast Guard Ship

CDR

critical design review

CEA

Central Engineering Agency

CEM

Cabin Emergency Manual

CF

Canadian Forces

CFAV

Canadian Forces Auxiliary Vessel

CFB

Canadian Forces Base

CFD

computational fluid dynamics

CFM

cubic feet per minute

CFR

Code of Federal Regulations (USA)

CFS

cabin file server

CHS

Canadian Hydrographic Services

cm

centimetre

CME

Chief Medical Examiner

CMU

communications management unit

C of G

centre of gravity

COMPT

compartment

CPD

circuit protection (or protective) device

CPU

central processing unit

CRE

component responsible engineering

CRES

corrosion resistant

CRM

cockpit (or crew) resource management

CRP

communication radio panel

CSD

certification supporting document

CSR

Canadian Seabed Research

CSRTG

Cabin Safety Research Technical Group

CTIU

cabin telephone interface unit

CUMA

Canadian Underwater Mine-countermeasures Apparatus

CVFR

controlled visual flight rules

CVIS

cabin video information system

CVR

cockpit voice recorder

CYAW

Halifax Shearwater Airport (Nova Scotia)

CYHZ

Halifax International Airport (Nova Scotia)

CYQI

Yarmouth Airport (Nova Scotia)

CYQM

Greater Moncton Airport (New Brunswick)

D

D

energy density expressed in J/m²

DAS

Designated Alteration Station

DAU

disk array unit

dB

decibel

dBi

decibel isotropic

dBm

decibel referenced to 1 milliwatt

dBZ

a unit of radar reflectivity used in meteorology

DC

direct current

DCAS

digitally controlled audio system

DDS

The FAA's DAS, DOA, and SFAR 36 Program

DEU

display electronic unit

DFDAU

digital flight data acquisition unit

DFDR

digital flight data recorder

DFO

Department of Fisheries and Oceans

DIN

Deutsche Industrie Norm

DITS

digital information transfer system

DME

distance measuring equipment

DMS

Douglas Material Specification

DNA

deoxyribonucleic acid

DND

Department of National Defence

DOA

Delegation Option Authorization

DPS

Douglas Process Standard

DREA

Defence Research Establishment Atlantic

DSIS

Deep Seabed Intervention System

DTL

Decorative PVF laminate

DTM

digital terrain model

DU

display unit

E

E

electric field strength

E&E

electrical and electronic equipment

EAD

engine and alert display

EAPAS

Enhanced Airworthiness Program for Airplane Systems

EC

Environment Canada

ECM

electronic countermeasures

EDP

engine-driven hydraulic pump

EDT

eastern daylight savings time

EEC

electronic engine control

EEPROM

electrically erasable programmable read-only memory

EIRP

effective isotropic radiated power

EIS

electronic instrument system

ELA

electrical load analysis

ELT

emergency locator transmitter

EMC

electromagnetic compatibility

EMI

electromagnetic interference

EMO

Emergency Measures Organization (or Office)

EO

engineering order

EPC

Emergency Preparedness Canada

EPCU

electrical power control unit

EPR

engine pressure ratio

ESC

environmental system controller

ETFE

ethylene-tetrafluoroethylene

ETOPS

Extended Range Twin Engine Operations

EUROCAE

European Organisation for Civil Aviation Equipment

EXT

extended

F

°F

degree(s), Fahrenheit

F/A

flight attendant

FA1W

Northeast Region Area Forecast

FAA

Federal Aviation Administration (USA)

FACN35

Canadian area forecast, District 35

FADEC

full-authority digital electronic control

FAR

Federal Aviation Regulation (USA)

FAUS5

US Area Forecast

FBS

fixed-base simulator

FBV

French Bureau Veritas

FCC

flight control computer

FCOM

Flight Crew Operating Manual

FCP

flight control panel

FCRL

flight crew reading light

FD

flight director

FDAU

flight data acquisition unit

FDCU

fire detection control unit

FDM

Flight Data Monitoring

FDR

flight data recorder

FDU(A)

Fleet Diving Unit (Atlantic)

FE

flap extension

FEP

fluorinated ethylene-propylene [resin]

FH

flight hours

FIB

focused ion beam

FL

flight level

FMA

flight mode annunciator

FMC

flight management computer

FMS

flight management system

FMU

fuel metering unit

FO

first officer

FOC

Flight Operations Centre (Swissair)

FOCA

Federal Office for Civil Aviation (Switzerland)

FOCUS

flight operations computer system

FOEB

Flight Operations Evaluation Board

FOO

flight operations officer

FOQA

flight operational quality assurance

fpm

feet per minute

FR

fluid-resistant [primer paint]

FS

frame station

FSAW

Flight Standards Information Bulletin for Airworthiness

FSB

Flight Standardization Board

FSC

fuel system controller

FSEG

Fire Safety Engineering Group - University of Greenwich

FSR

field service representative

FSS

flight service station

ft.

foot (feet)

FWD

forward

G

g

gravity

GB

gigabyte

GB

Swissair General/Basics: Flight Crew [manual]

GCU

generator control unit

GES

ground earth station

GHz

gigahertz

GIS

Geographic Information System

gpm

gallons per minute

H

h

hour(s)

HCU

hydraulic control unit

HDD

hard-disk drive

HDS

Halon Distribution System

HDU

head-end distribution unit

HF

high frequency

HI

Hollingsead International

HIRF

high-intensity radiated field

HMCS

Her Majesty's Canadian Ship

HMU

hydro-mechanical unit

HPC

high-pressure compressor

HPT

high-pressure turbine

HSC

hydraulic system controller

HTML

Hypertext Markup Language

Hz

hertz

I

IAS

indicated airspeed

IC

integrated circuit

ICA

Instructions for Continued Airworthiness

ICAO

International Civil Aviation Organization

IDG

integrated-drive generator

IDN

identification number

IFE

in-flight entertainment

IFEN

in-flight entertainment network [the IFE system of Interactive Flight Technologies]

IFR

instrument flight rules

IFT

Interactive Flight Technologies

IGV

inlet guide vanes

IIC

investigator-in-charge

ILS

instrument landing system

IMC

instrument meteorological conditions

in.

inch(es)

in. Hg

inches of mercury

INMARSAT

International Maritime Satellite Organization

IPC

Illustrated Parts Catalogue

IRU

inertial reference unit

ISE

International Submarine Engineering Ltd.

ISO

International Organization for Standardization

ISOL

isolation

ISVD

in-seat video display

IVR

image-based virtual reality

J

J

joule

JAA

Joint Aviation Authorities

JAR

Joint Aviation Requirements

JCAB

Civil Aviation Bureau of Japan

JFK

John F. Kennedy [International Airport] (New York)

K

kB

kilobyte

KBGR

Bangor International Airport (Maine)

KBOS

General Edward Lawrence Logan International Airport (Massachusetts)

kg

kilogram

kHz

kilohertz

KIAS

knots indicated airspeed

km

kilometre(s)

kPa

kilopascal(s)

kt

knot(s)

kV

kilovolt(s)

kVA

kilovolt-ampere

kW

kilowatt(s)

L

L

litre

L/min

litres per minute

LAACO

Los Angeles Aircraft Certification Office

LAN

local area network

lat.

latitude

LAV

lavatory

lb

pound(s)

lb/min

pound(s) per minute

lbf

pound force

LCD

liquid crystal display

LEAF

Laser Environmental Airborne Fluorosensor

LKP

last known position

LLS

laser line scan

LLSG

Geneva International Airport (Switzerland)

LOI

Letter of Intent

long.

longitude

LOPA

Layout of Passenger Accommodation

LP

low pressure

LPC

low-pressure compressor

LPT

low-pressure turbine

LRU

line replaceable unit

LRW

Laurentides

LSAS

longitudinal stability augmentation system

LVDT

linear variable differential transducer

M

M

Mach number

°M

degree(s), magnetic compass

m

metre

MAC

mean aerodynamic chord

MACZFW

mean aerodynamic chord zero fuel weight

MANOPS

[ATC] Manual of Operations

MAPRC

modified aromatic polyimide resin coating

MAR

main avionics rack

MB

megabyte

M/C

maître de cabine

MCDU

multifunction control display unit

MCU

Major Crimes Unit

MD

McDonnell Douglas

MDC

McDonnell Douglas Corporation

MDF

main debris field

MDL

master data list

METAR

aviation routine weather report

MFM

Modified Frequency Modulation

MHz

megahertz

mi.

mile(s)

MIDO

Manufacturing Inspection District Office

MIL

military [standard]

min

minute(s)

mJ

millijoule

mL

millilitre(s)

MM

maintenance manual

mm

millimetre(s)

MO

Modification Order

MOC

Military Operations Centre

MOE

maintenance organization exposition

MPEG

Motion Pictures Experts Group

MPET

metallized polyethylene terephthalate

MPVF

metallized polyvinyl fluoride

MRB

Maintenance Review Board

ms

milliseconds

MSC

miscellaneous system controller

MSEP

Marine Safety and Environmental Protection

msl

mean sea level

MTEB

management terminal electronic box

MTOW

maximum take-off weight

MU

management unit

mV

millivolt

MVD

management video display

MW

megawatt

N

N/A

not applicable

N/C

no change

N₁

rotational speed of the low-pressure compressor in rpm or % rpm

N₁c2

corrected low-pressure rotor speed (derived from Tt2)

N₂

rotational speed of the high-pressure compressor in rpm or % rpm

N₂c2

corrected high-pressure rotor speed (derived from Tt2)

NARDS

Nav Canada Auxilliary Radar Display System

NAV

navigation

NAVAID

navigational aid

NCD

no computed data

ND

navigation display

NDB

non-directional [radio] beacon

NDU

no data update

NFPA

National Fire Protection Association

nm

nautical mile(s)

NORDO

no radio (absence or failure of radio equipment)

NPR

National Program Review

NPRM

Notice of Proposed Rulemaking

NRMP

non-reversible motor pump

NS TPW

Nova Scotia Department of Transportation and Public Works

NSU

network switching unit

NTO

no technical objection

NTSB

National Transportation Safety Board (USA)

NVM

non-volatile memory

NWS

National Weather Service

O

OCME

Office of the Chief Medical Examiner

OCR

optical character recognition

OD

outside diameter

ODA

Organizational Designation Authorization

OIG

Office of the Inspector General (USA)

oz

ounce(s)

P

P/B

push button

PA

passenger address

Pamb

pressure, ambient

PBE

protective breathing equipment

PBR

planning based on re-clearance

PET

polyethylene terephthalate

PF

pilot flying

PFD

primary flight display

PIC

pilot-in-command

PIREP

pilot report (of in-flight conditions)

PMA

Parts Manufacturing Approval

PMA

permanent magnet alternator

PN

part number

PNF

pilot not flying

PSEU

proximity sensor electronic unit

psi

pounds per square inch

psia

pounds per square inch absolute [pressure]

psig

pounds per square inch gauge

PSU

power supply unit

Pt2

fan inlet total pressure

Pt4.95

total pressure at station 4.95 (exhaust)

PTFE

polytetrafluoroethylene

PTT

push-to-talk

PVC

polyvinyl chloride

PVF

polyvinyl fluoride

PVF₂

polyvinylidene fluoride

PWGSC

Public Works and Government Services Canada

Q

QA

quality assurance

QAR

quick access recorder

QN

Queen of the Netherlands (name of dredge ship)

QNH

altimeter setting that references the indicated altitude to sea level

R

R&D

research and development

RA

radio altimeter

RAM

random access memory

RCC

Rescue Co-ordination Centre

RCCB

remote control circuit breaker

RCMP

Royal Canadian Mounted Police

RF

radio frequency

RGS

remote ground station

RMP

reversible motor pump

ROV

remotely operated vehicle

rpm

revolutions per minute

RPT

Radiant Panel Test

RTCA

Radio Technical Commission for Aeronautics

S

s

second(s)

SAE

Society of Automotive Engineers

SAI

standby attitude indicator

SAR

search and rescue

SARP

International Standards and Recommended Practices

SATCOM

satellite communications

SB

Service Bulletin

SBA

Santa Barbara Aerospace

SCN

Specification Change Notice

SCP

system control panel

SCR

Special Certification Review

SCU

supplemental control unit

SD

system display

SDCP

system display control panel

SDR

Service Difficulty Report

SDU

satellite data unit

SDU

seat disconnect unit (in discussion of IFEN system)

SEB

seat electronic box

SFAR

Special Federal Aviation Regulation (USA)

SGC

Site Group Chairperson

SID

standard instrument departure

SIGMET

significant meteorological information

SITA

Société Internationale de Télécommunications Aéronautiques (Airline Telecommunication and Information Services)

SL

Service Letter

sm

statute mile(s)

SN

serial number

SPOT

satellite pour l'observation de la terre

SR 111

Swissair Flight 111

SRM

Structural Repair Manual

SSS

side scan sonar

STA

manufacturing station

STAR

standard terminal arrival route

STC

Supplemental Type Certificate

SVA

stator vane actuator

SWR

Swiss Air Transport Company Ltd. (ATC designation)

T

°T

degree(s), True

t

tonne

TAF

terminal aerodrome forecast

TAS

true airspeed

TAT

total air temperature

TBD

to be determined

TC

Transport Canada

TCA

terminal control area

TCAS

traffic alert and collision-avoidance system

TCJC

temperature, cold junction, Celsius

TEC

turbine exhaust case

TED

trailing edge down

TEL

trailing edge left

TEM

transmission electron microscopy

TER

trailing edge right

TEU

trailing edge up

TO

Technical Order

torr

Torricelli, a non-metric unit of pressure equal to 1/760 atmosphere

TOW

take-off weight

TR

transformer rectifier

TRA

throttle resolver angle

TSB

Transportation Safety Board of Canada

TSO

Technical Standard Order

Tt2

total temperature of the air at Station 2 (compressor inlet)

Tt4.95

total temperature at Station 4.95 (exhaust)

TWA

Trans World Airlines

U

U/S

unserviceable

UL

Underwriter's Laboratory

ULB

underwater locator beacon

URT

Underwater Recovery Team

US

United States

USA

United States of America

USN

United States Navy

USS

United States Ship

UTC

Coordinated Universal Time

V

V

volt(s)

VA

volt-ampere

VES

video entertainment system

VHF

very high frequency

VMC

visual meteorological conditions

Vmin

FMC-calculated minimum operating speed

VOD

video on demand

VOR

very high-frequency omni-directional range [beacon]

VSV

variable stator vane

VTR

video tape recorder

VTU

verbal thought unit

W

W

watt

WAN

wide area network

WDM

Wiring Diagram Manual

WS

Work Statement

X

XL-ETFE

cross-linked ethylene-tetrafluoroethylene

Y

Y

axe longitudinal

Z

Z

axe vertical

Z

Zulu [time] (equivalent to UTC)

ZFW

zero fuel weight

Symbols

Å

Angstrom

λ

lambda (wavelength)

µm

micrometre(s)

ø

phase

π

pi (3.1416)

′

minute(s)

″

second(s)

°

degree(s)