Supporting technical information A98H0003

Flight recorder duration and power supply

Date issued: 09 March 1999

Forwarded to:

The Honourable David Michael Collenette, P.C., M.P.
Minister of Transport

Mr. K. Koplin, Secretary General
Joint Aviation Authorities, The Netherlands

Subject: Flight recorder duration and power supply

Background

On 02 September 1998 at 21:18 Atlantic daylight saving time, Swissair Flight 111 (SWR 111), a McDonnell Douglas MD-11 aircraft, HB-IWF, departed John F. Kennedy airport in New York, en route to Geneva, Switzerland. On board were 215 passengers and 14 crew members. Approximately 53 minutes after take-off, as the aircraft was cruising at Flight Level 330, the crew noticed an unusual smell in the cockpit. Within about three and a half minutes the flight crew noted visible smoke and declared the international urgency signal "Pan Pan Pan" to Moncton Area Control Centre, advising the Air Traffic Services (ATS) controller of smoke in the cockpit. SWR 111 was cleared to proceed direct to the Halifax airport from its position 58 nautical miles southwest of Halifax, Nova Scotia. While the aircraft was maneuvering in preparation for landing, the crew advised ATS that they had to land immediately and that they were declaring an emergency. Approximately 20 minutes after the crew first noticed the unusual smell, and about seven minutes after the crew's "emergency" declaration, the aircraft struck the water near Peggy's Cove, Nova Scotia, fatally injuring all 229 occupants on board.

To date, the investigation (A98H0003) has revealed heat damage consistent with a fire in the ceiling area forward and aft of the cockpit bulkhead. Both the Flight Data Recorder (FDR) and the Cockpit Voice Recorder (CVR) stopped recording while the aircraft was at approximately 10 000 feet, about six minutes before impact with the water.

Shortcomings related to the duration of CVR recordings and the supply of electrical power to flight recorders have been identified during this and other recent aircraft accident investigations.

Duration of cockpit voice recorder information

The CVR installed on SWR 111 employed a continuous-loop magnetic tape of 30 minutes duration. The earliest information on the SWR 111 CVR was recorded approximately 15 minutes before the unusual smell was noted by the crew. Crew conversations and cockpit sounds prior to the beginning of the CVR recording may have provided substantial insight into any initiating or precursor events that led to the accident.

Approximately 38 minutes prior to the unusual smell, Boston Center gave SWR 111 a radio frequency change. During the following 13 minutes Boston Center made repeated attempts to contact SWR 111, without establishing contact. Any cockpit conversations, flight deck noises, or attempted crew transmissions that occurred during this period were subsequently overwritten on the CVR, and therefore could not be assessed.

The 30-minute CVR recording capacity was predicated upon the technology available in the early 1960s; this was the amount of tape that could be crash-protected. The Board is concerned that 30 minutes of recording time is not adequate to capture the initiating events and important background information to many accidents. For example, in accidents involving in-flight fire or progressive structural failure, the initiating events typically develop over a period of time longer than 30 minutes. Longer CVR recording capacity also facilitates the investigation of non-catastrophic occurrences, occurrences in which current 30-minute recordings are often overwritten by the time the aircraft has safely stopped on the ground.

Current technology easily accommodates increased CVR recording capacity. In fact, the majority of newly manufactured solid-state memory CVRs have a two-hour recording capacity, and there is a worldwide industry move towards two-hour CVRs. The European Joint Airworthiness Requirements specify that aircraft first certified after 01 April 1998 be fitted with two-hour CVRs. There is also a proposal to include such a requirement in the Standards and Recommended Practices of the International Civil Aviation Organization (ICAO). The ICAO Flight Recorder Panel, consisting of experts from a number of States, met on 12-20 November 1998, and recommended to ICAO's Air Navigation Commission that aircraft manufactured after 01 January 2003 be fitted with two-hour CVRs.

The TSB is aware that many operators are voluntarily replacing their old technology (tape) data and voice recorders with modern, solid-state recorders. The use of these new recorders not only serves safety but also benefits operators directly, as they avoid the high costs and technical problems associated with maintaining outdated old-technology recorders. Additionally, tape recorders no longer meet the most recent United States Technical Standard Orders (TSO) C123a and TSO C124a crashworthiness standards. This industry trend to solid-state recorders makes it timely to require two-hour CVRs.

A lack of recorded voice and other aural information can inhibit safety investigations and delay or prevent the identification of safety deficiencies. Given the need for longer periods of recorded sound to capture the initiating events of aviation accidents and the availability of two-hour CVRs, the Board believes that such recorders should be mandated by regulatory authorities worldwide. However, it also recognizes that a period of several years may be reasonably required for manufacturers and operators to implement this change. Therefore, for newly manufactured aircraft, the Board recommends that:

Further, the Board believes that, with appropriate lead time, a retrofit program is warranted for aircraft already in service. Therefore the Board recommends that:

Independent power source

When aircraft power to the SWR 111 flight recorders was interrupted at 10 000 feet, the FDR and CVR stopped recording. The aircraft continued to fly for about six minutes with no information being recorded. This lack of recorded information has hampered the accident investigation.

Power interruptions have resulted in flight recorder information not being captured during the last minutes of several other recent aircraft occurrences. These include ValueJet (Miami, Florida; DC-9-32; 11 May 1996), TWA flight 800 (East Moriches, New York; Boeing 747-131; 17 July 1996), SilkAir (Palembang, Indonesia; Boeing 737-300; 19 December 1997), Delta Air Lines (Cork, Ireland; MD-11; 08 October 1998), and Delta Express (Orlando, Florida, Boeing 737-232; 15 December 1998).

In modern aircraft, flight data and other data from multiple sources are used by the aircraft systems and by the flight crew to operate the aircraft. To record the parameters it needs, the FDR simply monitors the data flowing through data buses. If electrical power to a particular sensor or data bus is lost, FDR information pertaining to that sensor or data bus will no longer be available. In the event of a total loss of electrical power, essentially there would be no data to record. There may be merit in independently powering the FDR and its flight data acquisition unit in order to capture whatever data are available during partial electrical failures. However, as a minimum, the TSB believes the CVR and its cockpit area microphone must continue to be powered for short periods regardless of the availability of normal aircraft electrical power. This independent power source would allow the continued recording of the acoustic environment of the flight deck, including cockpit conversations and ambient noises, for a specific period.

With maintenance-free independent power sources, it is now feasible to power new-technology CVRs and the cockpit area microphone independently of normal aircraft power for a specific period of time in the event that aircraft power sources to the CVR are interrupted or lost. Therefore, to enhance the capture of CVR information needed for accident investigation purposes, the Board recommends that:

Separate electrical buses

In the current configuration of the MD-11, the FDR and CVR installations are both powered from generator AC Bus No. 3. The MD-11 emergency checklist, dealing with smoke/fumes of unknown origin, requires the use of the SMOKE ELEC/AIR switch. This switch is used to cut power to each of the three electrical buses in turn, in order to isolate the source of the smoke/fumes. The nature of this troubleshooting procedure requires that the switch remain in each position for an indeterminate amount of time, typically at least a few minutes. When the SMOKE ELEC/AIR switch is placed in the first (3/1 OFF) position, generator AC Bus No. 3 and No. 1 air conditioning packs are turned off, thereby simultaneously disabling the FDR and the CVR. Additionally, if the smoke/fumes are cleared in this first position, the SMOKE ELEC/AIR switch is to remain in this position for the duration of the flight, which means that the CVR and FDR both remain inactive while there are data to be recorded. Although it has not been established whether the recorders on SWR 111 stopped as a result of deteriorating electrical systems or the selection of the SMOKE ELEC/AIR switch, the fact that both recorders can be disabled by a single switch selection poses an unnecessary risk of losing critical recorder information.

The Federal Aviation Administration's FAR 25.1457 (CVR) and FAR 25.1459 (FDR), Transport Canada's Canadian Aviation Regulations Standards Part V–Airworthiness Manual, Chapter 551, Articles 551.100 and 551.101, and European Civil Aviation Electronics (Eurocae) specifications require that recorders be installed so that they receive power from the electrical bus that provides the maximum reliability for operation without jeopardizing service to essential or emergency loads. With both the CVR and the FDR on the same generator bus, however, a failure of that bus or the intentional disabling of the bus (as could result from checklist actions in an emergency) result in both recorders losing power simultaneously.

To enhance the capture of information needed for the identification of safety deficiencies, the Board recommends that:

There is increasing industry recognition of the operational and safety benefits associated with the installation of two combined voice and data recorders. The Board is supportive of this concept and believes that the intent of the foregoing recommendations would be met if an aircraft was equipped with two such recorders; provided they are powered from separate generator buses, and they each employ a two-hour CVR and a dedicated independent power supply. Also, it would be preferable, in most aircraft, to place one such recorder in the nose of the aircraft and the other in the tail.

As the investigation proceeds, should the Board identify additional safety deficiencies in need of urgent attention, it will not hesitate to make further aviation safety recommendations.

Benoît Bouchardd

Chairman
On behalf of the Board

Thermal acoustical insulation materials

Date issued: 11 August 1999

Forwarded to:

The Honourable David Michael Collenette, P.C., M.P.
Minister of Transport

Mr. K. Koplin, Secretary General
Joint Aviation Authorities, The Netherlands

The Honourable Jane Garvey, Administrator
Federal Aviation Administration, United States

Subject: Thermal Acoustical Insulation Materials

Background

On 02 September 1998 at 2118 Atlantic daylight saving time, Swissair Flight 111 (SWR 111), a McDonnell Douglas MD-11 aircraft, HB-IWF, departed John F. Kennedy airport in New York, en route to Geneva, Switzerland. On board were 215 passengers and 14 crew members. Approximately 53 minutes after take-off, as the aircraft was cruising at Flight Level 330, the crew noticed an unusual smell in the cockpit. Within about three and a half minutes, the flight crew noted visible smoke and declared the international urgency signal "Pan Pan Pan" to Moncton Area Control Centre, advising the Air Traffic Services (ATS) controller of smoke in the cockpit. SWR 111 was cleared to proceed direct to the Halifax airport from its position 58 nautical miles southwest of Halifax, Nova Scotia. While the aircraft was manoeuvring in preparation for landing, the crew advised ATS that they had to land immediately and that they were declaring an emergency. Approximately 20 minutes after the crew first noticed the unusual smell, and about seven minutes after the crew's "emergency" declaration, the aircraft struck the water near Peggy's Cove, Nova Scotia, fatally injuring all 229 occupants on board. Because the aircraft crashed into the ocean, there was no post-crash fire.

To date, the investigation (A98H0003) has revealed fire damage in the ceiling area forward of and several metres aft of the cockpit bulkhead. While the source of ignition has yet to be determined, there are clear indications that a significant source of the combustible materials that sustained the fire was thermal acoustical insulation blanket materials. Burnt remnants of this material, quenched by the sea water, were found in the wreckage.

Shortcomings related to the in-service fire resistance of some thermal acoustical insulation materials, and shortcomings in the test criteria used to certify those materials, have been identified during this and other recent aircraft occurrence investigations.

Thermal Acoustical Insulation Blanket

Thermal acoustical insulation blankets are widely used in the aviation industry to protect the aircraft interior from temperature variations, noise and moisture. Typically, blanket construction consists of a batt of insulating material encapsulated by a cover or film. Depending on the blanket size required, tape may be used to seal several blankets into a single unit. Selection of cover material is based on factors such as durability, fire resistance, weight, impermeability, and installation considerations. The most widely used cover materials in the aviation industry are metallized polyvinyl fluoride (PVF)^{Footnote 1} and metallized and non-metallized polyethylene terephthalate (PET).^{Footnote 2} The MD-11 involved in this accident was fitted with metallized PET.

The Douglas Aircraft Company first introduced reinforced plastic film insulation coverings during the development of the DC-10. By 1987, the manufacturer (then McDonnell Douglas Corporation) began installing insulation blankets having metallized PET cover material on production aircraft. Further research and development resulted in the use of lighter, non-metallized PET thermal acoustical insulation blankets, which were introduced in 1994 and which superseded metallized PET cover material on new production aircraft. The McDonnell Douglas aircraft produced with metallized PET-covered insulation blankets include the following models: DC-10, MD-80, and MD-11. The total number of aircraft worldwide that have used this material for replacement or repair has not been ascertained. However, it is clear that a large number of aircraft are using, in whole or in part, thermal acoustical insulation blankets incorporating metallized PET cover material.

Metallized PET-covered insulation blankets are used throughout the MD-11 aircraft, including extensive use in the ceiling area forward and aft of the cockpit bulkhead where fire damage has been discovered in the accident aircraft. The investigation has found samples of metallized PET that had been burning. Appendix A provides an overview of some other notable aircraft fires in which metallized PET insulation blanket covering was considered to have aggravated the damage in the occurrence.

In September 1996, prompted by several MD-80 and MD-11 ground fire incidents involving insulation blankets with metallized PET cover material, McDonnell Douglas advised operators to discontinue the use of this material. Additionally, the company stated that it was currently installing non-metallized PET cover material in production aircraft. By 1997 metallized PVF was being used in production aircraft. By October of that year McDonnell Douglas had issued a Service Bulletin (MD-11-25-200) that encouraged MD-11 operators to replace insulation blankets covered with metallized PET material with blankets covered with metallized PVF material. The Service Bulletin also stated that the non-metallized PET cover material that had been used in production aircraft since September 1996 was discontinued, as it did not consistently pass a particular McDonnell Douglas flammability test. That Bulletin also stated that McDonnell Douglas was now using metallized PVF in new production aircraft. Similar Service Bulletins, regarding the use of metallized PET cover material, were issued to DC-8, DC-9, DC-10, MD-80, and MD-90 operators.

Manufacturer's Service Bulletins are advisory in nature unless mandated by the issuance of an Airworthiness Directive by the appropriate regulatory authority.

Thermal acoustical insulation, insulation covering, and insulation blankets must comply with the flammability requirements as described in U.S. Federal Aviation Regulation (FAR) 25.853, Appendix F. In 1997, concerned with the number of incidents involving flame propagation on thermal acoustical insulation blankets, the Federal Aviation Administration (FAA) Research and Development Division conducted a study to evaluate flammability test conditions beyond those called for in Appendix F of FAR 25.853. The study involved testing a variety of insulation blanket cover materials, including metallized PET. The metallized PET samples failed the expanded set of test conditions, prompting the study to conclude that the particular grade of metallized PET cover material used in the evaluation was flammable and possibly could propagate a fire under certain conditions. In March and May 1999 the FAA conducted burn tests as part of its continuing efforts to improve the test criteria required under FAR 25.853 Appendix F. A mock-up was fitted with insulation blanket material to simulate the top part of the fuselage of a commercial aircraft. The preliminary results demonstrated that metallized PET materials could be ignited and that the resulting fires could spread, generating large amounts of smoke under certain conditions and thus exacerbating the emergency associated with an in-flight fire. These results are consistent with observations from the previously referenced in-service fires and other FAA testing results.

With the in-service history, the demonstrated flammability of the metallized PET cover material, and the discovery, in the Swissair Flight 111 wreckage, of remnants of insulating blankets with cover material burnt, it is likely that this material was a significant source of the combustible materials that propagated the fire. It is the Board's view that the operation of aircraft outfitted with thermal acoustical insulation blankets incorporating metallized PET cover material constitutes an unnecessary risk. Therefore, the Board recommends that:

Flammability test criteria

The flammability test for thermal acoustical insulation, insulation covering, and insulation blankets, as stated in Appendix F of FAR 25.853, necessitates a vertical flammability test of samples using an approved burner. The type of cover material on the insulation blankets installed on the Swissair aircraft had been subjected to this test and met the applicable flammability test criteria for FAA certification.

In-service fires of the metallized PET cover material, and inconsistent results from the vertical burn test method specified by FAR 25.853, prompted manufacturers to seek additional flammability test criteria. Subsequently, aircraft manufacturers developed a "cotton swab" test, which yielded more consistent results when testing the flammability characteristics of the various cover materials. This additional testing was adopted by several major aircraft manufacturers who subsequently modified their internal material specifications. In 1996, based on results of the "cotton swab" test, McDonnell Douglas advised its customers not to use metallized PET, and discontinued its use in production aircraft. In 1997 an FAA sponsored study confirmed that the "cotton swab" test was a more reliable and reproducible test method to assess the flammability characteristics of metallized PET cover material; however, the FAA did not amend FAR 25.853, Appendix F to improve test standard requirements.

As the incidents listed in Appendix B attest, the limitations of the FAR 25.853, Appendix F, test criteria may not be confined to its inability to accurately and reliably identify the flammability characteristics of metallized PET cover material.

On 14 October 1998 the FAA stated that the test criteria used to certify the flammability characteristics of thermal acoustical insulation materials were inadequate, and committed itself to conducting the research necessary to establish a more comprehensive test standard. At the same time, the FAA indicated that because materials containing polyimide film have performed well in preliminary flammability tests, these materials would be considered compliant under the new regulation. Until adequate flammability test criteria are available, it is not possible to determine whether polyimide film, or other materials, provide adequate protection against fire propagation. Thermal acoustical insulation materials are installed in aircraft as a system, including such related components as tape, fasteners, and breathers. The Board believes that thermal acoustical insulation materials for use in aircraft must be judged against more valid flammability test criteria, not as individual components, but as a system. Therefore, the Board recommends that:

As the investigation proceeds, should the Board identify additional safety deficiencies in need of urgent attention, it will make further aviation safety recommendations.

Benoît Bouchard

Chairperson
On behalf of the Board

Appendix A

The following accident synopses represent selected occurrences in which metallized PET insulation blanket cover material was involved.

• 24 November 1993: a McDonnell Douglas MD-87 experienced a fire while taxiing. Initially, the smoke emerged from the aft right side of the cabin. After the passengers and crew had disembarked, the fire intensified dramatically and spread quickly. Investigators determined that the metallized PET-covered insulation blankets acted as fuel sources that helped to spread the fire. [Aircraft Accident Investigation Board, Denmark]
• 06 September 1995: a McDonnell Douglas MD-11 experienced a fire in the Electronics and Engineering bay. Investigators found that molten metal from arcing wires had fallen on metallized PET-covered insulation blankets adjacent to the fuselage skin causing extensive flame propagation and widespread fire damage. [Minister of General Administration of Civil Aviation of China, People's Republic of China]
• 26 November 1995: a McDonnell Douglas MD-82 experienced a cabin fire prior to take-off. A ruptured light ballast case ignited a fire, which spread rapidly with extensive flame propagation on the metallized PET-covered blankets. [Civil Aviation Department, Republic of Italy]
• 08 November 1998: a fire broke out during loading operations of a McDonnell Douglas MD-11. Indications are that a cargo pallet was inadvertently pulled over an electrical cable that supplied power to one of the cable deck floor rollers. A box containing electronic circuitry sparked, which ignited a nearby metallized PET-covered insulation blanket. [National Transportation Safety Board, U.S.]
• 29 March 1999: a McDonnell Douglas MD-11 freighter undergoing maintenance was discovered to have insulation blanket material displaying evidence of fire damage. Preliminary investigation results reveal that chafed wires, located under the floorboards of the aft cargo compartment, had arced, causing nearby metallized PET-covered insulation blanket to ignite. The fire propagated to cover an area of insulation blanket of approximately 60 inches by 26 inches. [National Transportation Safety Board, U.S.]

Appendix B

The following accident synopses represent selected occurrences in which metallized PVF insulation blanket cover material was involved.

• 10 October 1994: after landing, ground crew detected a burning smell on a Boeing 737-100. Upon investigation, it was discovered that an improperly installed wire clamp had caused a short circuit. The subsequent arcing ignited nearby insulation blanket that used metallized PVF cover material. [Minister of General Administration of Civil Aviation of China, People's Republic of China]
• 13 November 1995: during a maintenance inspection on a Boeing 737-300 a nut bolt had to be removed using an air drill. This action produced hot metal chips that ignited the metallized PVF insulation blanket cover material under the floor. Flames propagated to consume an area of 18 inches by 40 inches. [Minister of General Administration of Civil Aviation of China, People's Republic of China]

In-flight firefighting

Date issued: 04 December 2000

Forwarded to:

The Honourable David Michael Collenette, P.C., M.P.
Minister of Transport

Frank Hilldrup
Accredited Representative for SR 111 Accident
National Transportation Safety Board
United States

Jean Overney, Chief Inspector
Aircraft Accident Investigation Bureau
Switzerland

Subject: In-flight firefighting

The circumstances of the Swissair Flight 111 accident

On 02 September 1998, Swissair Flight 111 (SR 111), a McDonnell Douglas MD-11 aircraft, was travelling from New York to Geneva with 215 passengers and 14 crew on board. Approximately 53 minutes after take-off, as the aircraft was cruising at flight level 330, the crew noticed an unusual smell in the cockpit. Within about three and a half minutes, the flight crew noted smoke and declared the international urgency signal "Pan Pan Pan" to Moncton Air Traffic Services (ATS). SR 111 was cleared to the Halifax airport from its position 58 nautical miles to the southwest. While manoeuvring in preparation for landing, the crew advised ATS that they had to land immediately and declared an emergency. Approximately 20 minutes after the crew first noticed the unusual smell, and about 7 minutes after the crew's "emergency" declaration, the aircraft struck the water near Peggy's Cove, Nova Scotia, fatally injuring all 229 occupants.

Background

The aircraft crashed into the ocean, and all fire damage occurred in flight. The investigation (A98H0003) has identified extensive fire damage above the ceiling in the forward section of the aircraft extending about 1.5 metres forward and 5 metres aft of the cockpit bulkhead. Although the origin of the fire has not been determined, the investigation has revealed safety deficiencies in design, equipment, and crewtraining, awareness, and procedures related to in-flight firefighting. The elimination of these safety deficiencies would reduce the loss of life by increasing the probability of the prompt detection and suppression of in-flight fires.

The TSB is concerned with the approach taken by the aviation community in minimizing the risk and in addressing the means that are available for an aircraft crew to consistently detect and suppress fires within the pressurized portion of the aircraft.^{Footnote 3}

When confronted with an in-flight fire, an aircraft crew must be prepared to rely solely on their experience and training, and on the aircraft equipment at hand. Therefore, effective in-flight firefighting measures should allow an aircraft crew to quickly detect, analyse and suppress any in-flight fire.^{Footnote 4} While it is difficult to predict how much time might be required to bring a particular in-flight fire under control, the earlier a fire is detected, the better.

Anecdotal information suggests that odour/fumes/smoke occurrences that do not develop into in-flight fires are not unusual but that, where an in-flight fire does develop, there is very little time available to gain control of the fire. The TSB reviewed a number of databases to validate this information. The review confirmed that there are numerous odour/fumes/smoke occurrences; however, occurrences leading to accidents as a result of uncontrolled fires similar to SR 111 are rare. Details of the TSB review of available data are included in Appendix A. This sample of in-flight fire accidents was compiled based on similarity to SR 111. These data indicate that, in situations where there is an in-flight fire that continues to develop, the time from detection until the aircraft crashed varied from 5 to 35 minutes.

Furthermore, the TSB looked at numerous in-flight fire events that, because of variances with the criteria established for the review, were not included in the validation process. Many of these events resulted in fatalities and each contains examples of where one or more components of the firefighting system failed to provide adequate protection. Appendix B contains a sample of these events.

Safety deficiencies

The TSB has identified safety deficiencies in several aspects of the current government requirements and industry standards involving in-flight firefighting. These deficiencies increase the time required to assess and gain control of what could be a rapidly deteriorating situation. When viewed together, these deficiencies reflect a weakness in the efforts of governments and industry to recognize the need for dealing with in-flight fire in a systematic and effective way.

The Board's interim air safety recommendations address safety deficiencies in the following areas:

• The lack of a coordinated and comprehensive approach to in-flight firefighting increases the overall risk.
• Smoke/fire detection and suppression systems are insufficient.
• The importance of making prompt preparations for a possible emergency landing is not recognized.
• The time required to troubleshoot smoke/fire problems is excessive.
• Access to critical areas within aircraft is inadequate.

Integrated firefighting measures

An important aspect of the Board's mandate to advance transportation safety is to look beyond the specific circumstances of any single occurrence and identify systemic safety deficiencies. Over the years, lessons learned from a number of accidents have resulted in modifications to aircraft, systems, and procedures as a direct response to specific failures.^{Footnote 5} However, aircraft and equipment design changes aimed at providing better firefighting measures have sometimes been made in isolation from each other. Although considerable efforts have been made to prepare and equip aircraft crews to handle in-flight fires, these efforts have fallen short of adequately preparing aircraft crews to detect, locate, access, assess, and suppress in-flight fires in a coherent and coordinated manner.

In-flight firefighting "systems" should include all procedures and equipment necessary to prevent, detect, control, and eliminate fires in aircraft. This systems approach would include material flammability standards, accessibility, smoke/fire detection and suppression equipment, emergency procedures and training. All of these components should be examined together and the inter-relationships between individual firefighting measures should be re-assessed with a view to developing improved, comprehensive firefighting measures. The Board believes that the most effective in-flight firefighting capability will exist when the various elements of the firefighting system are integrated and complementary; it therefore recommends:

Smoke/Fire detection and suppression

Designated fire zones

Presently, the requirements for built-in smoke/fire detection and suppression systems are restricted to those areas that are not readily accessible, and in which a high degree of precaution must be taken.^{Footnote 6} Areas such as these, either inside or outside the pressurized portion of the aircraft, are designated as "fire zones" due to the presence of both ignition sources and flammable materials. Consequently, aircraft manufacturers must provide built-in detection and suppression systems in powerplants (including Auxiliary Power Unit (APU)), lavatories, and cargo and baggage compartments.^{Footnote 7} The built-in suppression features are either automatic, as in lavatories, or controlled from the cockpit, as in powerplants. In each case the extinguishing agent must consist of an amount and nature tailored to the types of fire most likely to occur in the area where the extinguisher is used.^{Footnote 8}

There are no requirements for built-in smoke/fire detection and suppression systems in the remaining areas of the pressurized portion of the aircraft. Detection and suppression in non-designated fire zones, such as the cockpit, cabin, galleys, electrical and electronic equipment (E&E) compartments, and attic spaces are, for the most part, dependant on human intervention.^{Footnote 9}

Non-designated fire zones

Detection of smoke and fire in non-designated fire zones depends on the eyes, ears and noses of the crew and passengers. However, while some areas of an aircraft are almost certain to have a human presence during much of a flight, other areas, such as E&E compartments and attic areas, are more remote. A fire may ignite and propagate in these areas well out of the range of any human detection. The United States National Transportation Safety Board (NTSB) report on an Air Canada DC-9 in-flight fire that occurred near Cincinnati on 02 June 1983 suggests that the crew first detected smoke approximately 11 minutes after the related circuit breakers tripped.^{Footnote 10} Compounding this problem, in most transport category aircraft the occupied areas are isolated from the inaccessible areas by highly efficient aircraft ventilation/filtering systems, which can effectively remove combustion products from small fires. These systems can allow small fires to burn undetected by cabin occupants.^{Footnote 11}

Some areas not designated as fire zones have been treated as "benign", from a fire potential perspective. They have not been assessed by the aviation industry as needing built-in fire detection or suppression equipment. Furthermore, there has not been a recognized need either to train aircraft crews for firefighting in all of the non-designated fire zones, or to design aircraft so as to allow quick and easy access to these areas for firefighting purposes.

Aircraft materials must conform to fire-related standards. These requirements necessitate that materials used in compartment interiors, and in cargo and baggage compartments, meet the applicable test criteria.^{Footnote 12} In interim Air Safety Recommendation A99-08, dated 11 August 1999, the TSB identified limitations in these test criteria which allowed flammable material, used as a covering on thermal-acoustical insulation blankets, to be certified for use in aircraft. The Federal Aviation Administration (FAA) is actively pursuing a replacement program for a specific insulation cover material (metallized Mylar), which it deems to pose the greatest risk. Additionally, a more effective test is in development. The FAA's applicable Notices of Proposed Rulemaking (NPRMs) indicate that there are other insulation blanket cover materials that exhibit flame propagation properties similar to those of metallized Mylar.^{Footnote 13} Therefore, even with the FAA's metallized Mylar replacement initiatives, many inaccessible areas containing combustible materials will remain in aircraft remote from smoke/fire detection systems. Additionally, such materials, located in inaccessible areas, are prone to surface contamination which may provide fuel for flame propagation.

There are many spaces, including some large areas, within transport category aircraft that are seldom inspected and that can become contaminated with dust, debris and metal shavings. Inspections conducted under the auspices of the FAA's Aging Transport Non-Structural Systems Plan identified surface contamination on wiring bundles as a hazard.^{Footnote 14} The SR 111 investigation team has observed, in a variety of aircraft, similar contamination on insulation blanket material and on wire bundles. While the extent of the overall contamination problem has yet to be determined, over time debris such as metal shavings may damage wire insulation, which could lead to short-circuiting and, potentially arcing of wires. Additionally, dust and combustible debris would provide fuel and would contribute to fire propagation. Well-designed and well-executed maintenance programs may limit such contamination, but it is unlikely that contamination can be completely eliminated.

In recent years, there have been changes in requirements regarding detection and suppression in areas not previously designated as fire zones. For instance, the inclusion of lavatories as fire zones was largely a result of the lessons learned from the DC-9 accident near Cincinnati. The SR 111 accident, and other occurrences, clearly demonstrate that early detection and suppression are critical in controlling an in-flight fire. The present situation is inadequate, and more needs to be done to improve detection and suppression capabilities in some of the pressurized areas of aircraft. There are significant areas within the pressurized portion of the aircraft, not now deemed to be fire zones, that are virtually inaccessible and in which ignition sources and combustible materials may both be present.

The Board believes that the risk to the travelling public can be reduced by re-examining fire zone designations in order to determine which additional areas of the aircraft ought to be provided with enhanced smoke/fire detection and suppression systems. Therefore, the Board recommends:

The risk of remaining airborne – Emergency landing

Both the TSB review and an FAA study indicate that odour/smoke occurrences rarely develop into uncontrolled in-flight fires.^{Footnote 15} Within the aviation industry, there has been much debate concerning appropriate decision making when flight crews are faced with odour/smoke situations. Within the industry, many believe that one of these situations will likely turn out to be a "non-event." This expectation has led to a diminished concern about "minor" odours. Within the aviation industry, there is an experience-based expectation that the source of such odours will be discovered quickly and that troubleshooting procedures will "fix the problem." The same TSB review shows that in situations where there is an unsuppressed in-flight fire, there is a limited amount of time to get the aircraft safely on the ground. Therefore, in situations where odour/smoke from an unknown source occurs, the decision to initiate a diversion and a potential emergency landing must be made quickly.

There are a number of factors that could distract flight crews from initiating an immediate diversion and potential landing. These include: company culture; commercial considerations; general inconvenience; passenger comfort and safety concerns associated with initiating emergency descents; the complications inherent in a diversion to an unfamiliar airport; and aircraft operating limitations.

The SR 111 accident raised awareness of the consequences of an odour/smoke event, and the rate for flight diversions increased as a result. Typically, this post-accident awareness will subside. Recently, some airlines have modified their checklists and procedures to ensure that flight crews have policies, procedures, and training to divert and land immediately if visible smoke from an unknown source appears and cannot be readily eliminated. Along with other initiatives, Swissair amended their MD-11 checklist for "Smoke/Fumes of Unknown Origin" to indicate "Land at the nearest emergency aerodrome" as the first action item.

The Boeing Company issued a Flight Operations Bulletin (No. MD-11-99-04), which states: "Boeing advises that any time smoke has been detected and the source cannot be POSITIVELY identified and eliminated, the aircraft should be landed as soon as possible."

While such initiatives reduce the risk of an accident, the Board believes that more needs to be done, industry-wide. Along with initiating the other elements of a comprehensive firefighting plan, it is essential that flight crews give attention without delay to preparing the aircraft for a possible landing at the nearest suitable airport. Therefore, the Board recommends:

Time required to troubleshoot in odour/smoke situations

When the source of odour/smoke is not readily apparent, flight crews are trained to follow troubleshooting procedures, in checklists, to eliminate the origin of the odour/smoke. Some of these procedures involve removing electrical power or isolating an environmental system. A variable amount of time is required to assess the impact of each action. It can take a long time to complete the checklist, including troubleshooting actions. For example, the MD-11 Smoke/Fumes of Unknown Origin checklist can take up to 30 minutes to complete.^{Footnote 16} There is no regulatory direction or industry standard specifying how much time it should take to complete these checklists. The longer it takes to complete prescribed checklists, the greater the chance that a fire will become uncontrollable.

Troubleshooting procedures are most effective if the actions taken by the flight crew eliminate the source of the odour/smoke before it ignites a fire. These procedures can also eliminate an incipient fire if the crew detects the source early enough. However, once a fire reaches a stage where it is able to propagate without continuous re-ignition from the source, further troubleshooting to eliminate the source will not be sufficient to eliminate the fire.

Aircraft accident data indicate that a self-propagating fire can develop in a short period of time. Therefore, odour/smoke checklists must be designed such that the appropriate troubleshooting procedures are completed quickly and effectively. The Board is concerned that this is not the case and recommends:

Efficiency of fire suppression in the pressurized portion of the aircraft

Fire suppression for the pressurized portion of an aircraft is provided by hand-held fire extinguishers. The quantity and location of these fire extinguishers depends on the passenger capacity of the aircraft.^{Footnote 17} Hand-held fire extinguishers are mandatory in such spaces as the cockpit and galleys. The effectiveness of hand-held firefighting equipment depends on the size, type and location of the fire, on how accessible the fire is, and on crew training. By design, hand-held fire extinguishers are most effective against small fires, at limited range (up to three metres). Hand-held fire extinguishers have been used most successfully where the fire was small and accessible. In a large commercial aircraft such as the MD-11, there are areas to which the aircraft crew have only limited access and areas that are inaccessible. For example, it would be difficult for an aircraft crew to suppress some fires, using hand-held fire extinguishers, in the attic areas or E&E compartments of a large commercial aircraft.

Where access is relatively easy, such as exposed galley areas, existing procedures and training using hand-held fire extinguishers have proven to be adequate. However, where the source of the smoke/fire is not obvious, or access to the area is difficult, the situation can become hazardous very quickly. Areas that are not readily accessible have not been considered when planning for in-flight firefighting. Therefore, there has been little or no training provided for aircraft crews on how to access areas behind electrical or other panels, attic areas, or E&E compartments. Typically, present designs do not incorporate quick-access openings or other such means to facilitate access to these areas.

The TSB review of SR 111 and other in-flight fire occurrences has shown that where an in-flight fire continues to develop, there is little time between detection of the fire and the loss of aircraft control. It must be anticipated that aircraft systems will be affected, either as a direct result of the fire, or as a result of emergency procedures such as the de-powering of electrical buses. It is imperative that firefighting procedures be well defined and that aircraft crews be well trained in handling all in-flight fires.

Although aircraft crews are trained to fight in-flight fires, there are no requirements that cabin and flight crews train together, or that they be trained to follow an integrated firefighting plan and checklist procedure.^{Footnote 18} For example, neither flight crews nor cabin crews are trained to fight in-flight fires in the cockpit. Several operators contacted by the TSB indicate that flight crews and cabin crews do not receive training specific to fighting fire in the cockpit. The division of roles and responsibilities between the flight and cabin crews with respect to who will be combatting an in-flight fire in the cockpit is not clearly identified in manuals and company procedures.

An uncontrollable in-flight fire constitutes a serious and complicated emergency. A fire may originate from a variety of sources, and can propagate very rapidly. Time is critical. Aircraft crews must be knowledgeable about the aircraft and its systems, and be trained to combat any fire quickly and effectively in all areas, including those which may not be readily accessible. The Board believes that the lack of comprehensive in-flight firefighting procedures, and coordinated aircraft crew training to use those procedures, constitutes a safety deficiency. Therefore, the Board recommends:

As the investigation proceeds, should the Board identify additional safety deficiencies in need of urgent attention, it will make further aviation safety recommendations.

Benoît Bouchard

Chairperson
On behalf of the Board

Appendix A

The TSB reviewed data on in-flight fires that occurred between January 1967 and September 1998 to determine an average time between when an in-flight fire is detected and when the aircraft either ditches, conducts a forced landing, or crashes. To more accurately represent the scenario of Swissair Flight 111, instances where an aircraft landed successfully were not included in the sample. The review was limited to fires in commercial transport aircraft with a maximum take-off weight (MTOW) of more than 50,000 lbs. Included in the review were any fires that took place inside the fuselage (cargo, cabin and/or cockpit), while all engine fires, wheelwell fires and explosions (bombs) were excluded.

The data came from: ICAO, NTSB, the Aviation Safety Reporting System, TSB, AirClaims, and the Aviation Safety Network. As one would expect, some occurrences appeared in more than one database.

The following 15 occurrences were used to calculate the average of approximately 17 minutes:

The TSB research shows that, for an aircraft with an MTOW greater than 50,000 pounds, a fuselage fire that results in an accident is a rare event. The few relevant examples span some 31 years.

Appendix B

The following synopses represent selected occurrences in which a fire was involved.

• 11 July 1973: After reporting an in-flight fire, a B707 made a forced landing. The aircraft came to rest on its belly as it continued to burn. The investigation revealed that of the 134 people on board, 123 suffered fatal injuries due to smoke inhalation. The investigative agency's report recommended enhancements to smoke and heat detection throughout the aircraft, including areas behind the false ceiling. The report also called for improvements in crew communications and the operating instructions dealing with fire emergencies to enhance crew response during in-flight fire. (Bureau Enquêtes-Accidents, France)
• 19 August 1980: Approximately 7 minutes after take-off, the crew of an L-1011 received an aural warning indicating smoke in the aft cargo compartment. When the aircraft landed, some 20 minutes later, the fire had penetrated the cabin. All 301 on board perished in the fire. The investigative agency recommended, in part, the use of fire-blocking materials to control fire propagation, changes to crew emergency training, and a review of the operator's Standard Operating Procedures and emergency checklists. (Accident Investigation Authorities, Saudi Arabia)
• 16 October 1993: Approximately 10 minutes after take-off an MD-81 experienced smoke of increasing intensity in the cockpit overhead panel. The aircraft crew was unable to locate the source of the smoke and requested a return to their departure airport. Investigators discovered a failed emergency power switch which created a smoldering electrical fire. Additionally, it was determined that the emergency checklist procedures failed to eliminate the smoke. (German Federal Bureau of Aircraft Accidents Investigation)
• 05 September 1996: At FL 330 the flight crew of a McDonnell Douglas DC-10F were alerted to smoke in the cabin cargo compartment when smoke detectors activated. After a successful landing and evacuation the fire continued to burn and eventually destroyed the aircraft. The origin or propagation was never determined. (National Transportation Safety Board, USA)
• 09 January 1998: While in cruise, a Boeing 767 experienced abnormal warnings on the flight deck instrumentation accompanied by tripping of circuit breakers. The flight was diverted, and although the landing was successful, smoke appeared at the forward end of the passenger cabin. Investigators determined that the circuit breakers tripped as a result of electrical arcing/thermal damage to a wire bundle located in the E&E compartment. The investigation concluded that metal contamination was present on the wire bundle and probably assisted the onset of arcing. (Air Accidents Investigation Branch, United Kingdom)
• 09 November 1998: The flight engineer of a Lockheed L-1011 observed smoke, sparks and a small flame emanating from an overhead circuit breaker panel. Although the fire was successfully suppressed, multiple systems failures occurred during the descent. The investigation revealed that a circuit breaker had popped after arcing to an improperly installed wiring clamp. The arcing ignited dust and combustible debris at the back of the circuit breaker panel. (National Transportation Safety Board, USA)
• 28 November 1998: A Boeing 747 returned to its departure airport after an apparent fault associated with an E&E compartment cooling system ground exhaust valve. Investigators discovered several arced wires in a small wire harness associated with the exhaust valve. Insulation blanket cover material had subsequently ignited and was consumed by fire. (Air Accidents Investigation Branch, United Kingdom)

Material flammability standards

Date issued: 28 August 2001

Forwarded to:

The Honourable David Michael Collenette, P.C., M.P.
Minister of Transport

Ms. Carol Carmody
Acting Chairman
National Transportation Safety Board
United States

Jean Overney, Chief Inspector
Swiss Aircraft Accident Investigation Bureau
Switzerland

Subject: Material flammability standards

The circumstances of the Swissair Flight 111 accident

On 02 September 1998, Swissair Flight 111 (SR 111), a McDonnell Douglas MD-11 aircraft, was travelling from New York to Geneva with 215 passengers and 14 crew on board. Approximately 53 minutes after take-off, as the aircraft was cruising at flight level 330, the crew noticed an unusual smell in the cockpit. Within about three and a half minutes, the flight crew noted some smoke in the cockpit and declared the international urgency signal "Pan Pan" to Moncton Air Traffic Services. SR 111 was cleared to the Halifax airport from a position 57 nautical miles to the southwest. While the flight crew was manoeuvring the aircraft in preparation for the landing in Halifax, they were unaware that there was a fire spreading above the ceiling in the front area of the aircraft. About 11 minutes after the initial assessment by the crew that some visible smoke was present, the situation in the cockpit began to deteriorate rapidly. The autopilot disconnected and the aircraft's flight data recorder began to record a rapid succession of anomalies that reflected failures related to various aircraft systems. The flight crew declared an "emergency" and indicated a need to land immediately. Within about a minute thereafter, or about 12 minutes after the initial assessment of the existence of some visible smoke in the cockpit, radio communications and secondary radar contact with SR 111 was lost while the aircraft was in level flight at about 10 000 feet above sea level. About six minutes later, the aircraft crashed into the ocean near Peggy's Cove, Nova Scotia, Canada, fatally injuring all 229 occupants.

Background

Since the aircraft crashed into water, all fire damage occurred in flight. The ongoing investigation (A98H0003) has identified substantial fire damage above the drop-down ceiling in the forward section of the aircraft extending about 1.5 metres forward and 5 metres aft of the cockpit wall. Although the origin of the fire has not been determined, the investigation has revealed several safety deficiencies with respect to standards for material flammability. The elimination of these deficiencies would reduce the probability of loss of life resulting from in-flight fires.

In August of 1999 the Transportation Safety Board of Canada (TSB) issued two aviation safety recommendations.^{Footnote 19} These recommendations addressed safety deficiencies associated with the propensity of thermal acoustic insulation blankets covered with metallized polyethylene terephthalate (MPET) to propagate fire.^{Footnote 20} The recommendations focussed on the test criteria stipulated in the United States Federal Aviation Regulations (FARs) for the certification of such materials. Subsequently, the United States Federal Aviation Administration (FAA) issued airworthiness directives^{Footnote 21} mandating the removal of MPET-covered blankets from aircraft registered in the United States. Additionally, the FAA proposed regulatory changes that would require more rigorous testing of all thermal acoustic insulation materials.^{Footnote 22}

Safety deficiencies

Despite these initiatives, the TSB is concerned that there remain safety deficiencies in the material flammability standards, and that these pose an unacceptable risk to the flying public. First, in a series of aviation safety recommendations issued in December 2000 and entitled In-Flight Firefighting, the Board stated that material flammability standards for aeronautical products are an integral component of any in-flight firefighting "system." The Board is concerned that the flammability standards for certain materials used in the pressurized portion of an aircraft are inadequate.^{Footnote 23} Second, despite many initiatives to mitigate electrical wire discrepancies (including action taken subsequent to the issuance of TSB Aviation Safety Advisory 980031-1, 22 December 1998), the Board believes that the certification test criteria for aircraft wires do not adequately address the potential for wire failures to ignite or propagate fires. Third, indications that the failure of certain aircraft systems, such as crew oxygen, could exacerbate a fire in progress suggest that current requirements for conducting system safety failure analysis may be inadequate.

In summary, the Board's aviation safety recommendations address these safety deficiencies:

• the inadequacy of flammability standards for certain aircraft materials;
• the inadequacy of aircraft wire certification testing; and
• the inadequacy of system safety analysis to address the effects of potential system failures created by on-board fires.

Material flammability standards

Introduction

The investigation has assessed the flammability characteristics of the materials present in areas of the SR 111 aircraft damaged by fire, and the regulations and guidelines that apply to the certification of those materials. The most significant material flammability deficiency discovered has been the inappropriate flammability characteristics of the MPET-covered thermal acoustic insulation blankets. Other certified materials, discussed in Appendix A, also exhibit undesirable fire-propagation characteristics. The analysis of how these materials—either alone or in concert—may have contributed to the initiation and progress of the SR 111 fire is complex, and is ongoing. However, the flammability characteristics of the materials involved, and the speed with which the fire damage occurred, raise questions about the existing standard of flammability required for materials used in the fabrication of aeronautical products.

For the most part, civil aviation authoities (CAAs) maintain their own material flammability standards, and there are slight regulatory variations among national CAA jurisdictions. However, the standards are based on, or similar to, those described in the FARs, and this discussion will be confined to the material flammability standards specified by the FARs. These regulatory standards are the minimum required for certification of aircraft. Although not required by regulations, manufacturers routinely impose supplemental testing on materials used in their products.

Required testing

In general, each aircraft material must be tested to demonstrate its tendencies both to ignite and to propagate flame. The FAA has developed a series of tests which, in principle, are designed to represent the fire environment to which a given material may be exposed.^{Footnote 24} The FAA expectation is that one or more fire tests must be conducted on each material as a prerequisite to certification.^{Footnote 25} The number and severity of flammability tests required for a particular material largely depend on three criteria: the intended location of the material within the aircraft, the type, and the quantity. For example, materials used in one location, such as in partitions in occupied cabin interiors, may be subjected to more rigorous testing than materials used in other locations, such as some unoccupied spaces. Also, parts constructed of a particular type of material, such as elastomeric materials, may be subjected to less stringent tests, regardless of their intended location. Finally, the more of a particular material installed in an aircraft (either in greater quantities or in larger components), the more stringent the testing required for the material's certification.

Related research and development

Regulations are based upon ongoing efforts in research and development (R&D), which seek to continually improve fire safety in aviation. This R&D is primarily based on three factors: analysis of accidents and incidents, emerging technology, and new aircraft designs.^{Footnote 26} Although these efforts are international in scope, historically, the FAA has functioned as the lead agency as a direct consequence of its mandate.^{Footnote 27} Material flammability standards form an integral part of this R&D effort.

Current regulations are the result of efforts made over many years to utilize finite R&D resources to maximize safety improvements. In 1975–76 the FAA commissioned a study to determine the feasibility of, and the tradeoffs between, two basic approaches to providing fire safety improvements to the modern, wide-bodied transport fuselage.^{Footnote 28} Two approaches were investigated as part of that study:

• the application of the latest available technologies in early warning fire-detection and fire-extinguishing systems (described as a "fire management system"); and
• the application, in the cabin interior, of improved materials offering high fire-retardant qualities and low emissions of smoke and toxic gas.

The study concluded that there were merits and limitations in each approach, and that an approach combining a fire management system with selective material improvements may offer the most potential for providing timely fire protection in all cases.^{Footnote 29}

Ultimately, the thrust of R&D did not fully pursue this combined approach, and only limited follow-up research was conducted into the concept of developing an on-board fire management system.^{Footnote 30} It was reasoned that in-flight fires are rare, and typically originate in hidden and inaccessible areas; therefore, a limited use of the fire management concept would suffice. The best protection against in-flight fires, it was concluded, would be achieved through the targeted use of materials that have high fire-containment and ignition-resistance properties. It was concluded that such materials, combined with the selective use of early and reliable detection and efficient suppression techniques, would provide the required level of protection. R&D related to in-flight fires has led to increased fire protection in areas such as cargo compartments and lavatories.

While certain initiatives were taken to address the threat from in-flight fires, such as those mentioned above, the FAA's main R&D focus in the 1980s was towards increasing survivability in a post-crash fire environment. This R&D effort was, and continues to be, based on a post-crash scenario involving an intact fuselage adjacent to a fire that is sustained by uncontained aviation fuel. Full-scale burn tests using this scenario concluded that a post-crash fire within the aircraft would be sustained primarily by burning cabin interior materials. This FAA research also concluded that incapacitation of any potential survivors was primarily dependant upon toxic gases generated by a phenomenon known as "flashover."^{Footnote 31} At flashover, conditions rapidly deteriorate to a level at which survival is unlikely.^{Footnote 32} The inference—not universally accepted—is that the threat to occupants from combustion smoke and toxic/irritant gases, before flashover occurs, does not warrant the introduction of material toxicity standards. As a consequence, subsequent R&D has concentrated on developing improved flammability standards for cabin interiors, to delay the onset of flashover and thereby increase survivability. These efforts have resulted in major improvements to flammability standards for selected cabin materials, such as seat cushion fire-blocking layers and panels that release low levels of heat and/or smoke.

Consequence of current regulations concerning flammability standards

Based on the above, under current FAA regulations, the most stringent material flammability standards are reserved for large surface panels (such as sidewalls, ceilings, stowage bins and partitions) in the occupied areas of the aircraft. Flammability standards for materials used in the remainder of the aircraft interior are less stringent.

The FARs specify the level of fire protection required, based primarily on the location of a material within an aircraft. For most of the materials used outside the occupied areas of the cabin, the performance criteria are defined by the "horizontal Bunsen burner test" for miscellaneous materials, as specified in Appendix F to FAR Part 25 Part I.^{Footnote 33} Unlike other fire-testing methods, which measure flame time and burn length to establish a material's capacity to self-extinguish, the horizontal burn test only measures a material's rate of burn. For material that is subjected solely to the horizontal burn test, its only known flammability characteristic is whether it will burn at or below a pre-determined rate.^{Footnote 34} If such materials are not required to be self-extinguishing, they must be flammable^{Footnote 35} and capable of sustaining or propagating fire. Furthermore, as the highest flammability standards are reserved for large surface panels in occupied areas of the cabin, it is likely that the most flammable materials will be in remote, hidden, and inaccessible areas of an aircraft. Yet these are the areas where a variety of electrical ignition sources may initiate an in-flight fire, and where there are the fewest defences in terms of detection and suppression.

Summary of current FAR requirements

The current FAR requirements, as described above, result in the following material flammability hierarchy:

• flammable materials with an acceptable rate of burn;
• materials that will self-extinguish within an acceptable flame time and burn length; and
• selected cabin materials that will self-extinguish and release no more than a predetermined amount of heat and smoke.

Therefore, many aircraft materials currently in use are either flammable, or will burn within established performance criteria.

Additional fire-related testing

Only a limited number of materials, most of which are used in the passenger cabin, are certified using additional tests for smoke generation and heat release. Yet some in-flight fires have shown that smoke will migrate to the occupied areas of the aircraft and can impede the crew's ability to effectively deal with the associated emergency (see examples in Appendix B). Furthermore, within present regulations, no material is required to pass a certification fire test that measures toxicity. Beyond meeting a standard of flame time and burn length, there is no regulatory requirement to determine additional flammability characteristics for many materials used in aircraft.

Information on how materials not tested for flammability characteristics, such as heat release, smoke generation and toxicity, may contribute to the severity of an in-flight fire is contained in Appendix C. However, as these flammability characteristics are by-products of the combustion process, the Board believes that the most effective means to mitigate these additional threats is to eliminate the use of all materials that sustain or propagate fire.

Summary

Existing material flammability standards allow the use of flammable materials as well as materials that propagate flame within predetermined limits. In addition to the associated fire risk, the majority of these materials pose additional hazards, as there is no regulation requiring that other flammability haracteristics—such as heat release, smoke generation and toxicity—be measured. Currently, the most stringent fire tests are reserved for materials located in accessible cabin areas. As a consequence, some of the most flammable materials within the pressurized portions of an aircraft are located in hidden, remote or inaccessible areas. These areas pose a high risk of being involved in potentially uncontrollable in-flight fires.

The Board believes that the use of a material—regardless of its location, type, or quantity—that sustains or propagates fire when subjected to realistic ignition scenarios,^{Footnote 36} constitutes an unacceptable risk, and that, as a minimum, material used in the manufacture of any aeronautical product should not propagate or sustain a fire in any realistic operating environment. Therefore, the Board recommends that:

Material flammability test requirements for aircraft wiring

Large modern aircraft may contain more than 250 kilometres of wire of various sizes and insulating materials. Some digital flight control systems rely totally on wire interconnections, rather than the cables and pulleys used in earlier designs. The quantity and importance of electrical wire in aircraft is increasing.

During a detailed examination of the SR 111 wreckage, 20 electrical copper wires were found that displayed melted copper caused by an arcing event.^{Footnote 37} The significance of the arcs, in terms of whether or not they initiated the SR 111 fire, is under review; the possibility has not been ruled out. A review of data produced by the FAA, the Airline Pilots Association and Boeing shows that electrical systems have been a factor in approximately 50% of all aircraft occurrences involving smoke or fire, and that wiring has been implicated in about 10% of those occurrences. Significant examples of such occurrences can be found in Appendix D.

Unlike most materials used in the construction of aeronautical products, which are passive until involved in a fire, the failure of aircraft wiring has the capacity to play an active role in fire initiation. The failure of insulation material on a powered wire may create a high temperature arcing event and thereby ignite adjacent materials. However, despite the potential for wire to initiate a fire, the only material flammability test mandated for the certification of aircraft wire, including its associated insulation material, is the "60° Bunsen burner test."^{Footnote 38} This test method is designed to measure the burn length and extinguishing time of a given wire's insulation material. In effect, the sole material flammability performance criterion mandated for aircraft wire insulation material is the determination of how a single unpowered wire will behave when involved in a fire in progress. This is essentially the same basic flammability characteristic that is known about most passive materials used in the pressurized portion of the aircraft.

Typically, an aircraft wire that initiates an arcing event has sustained some preliminary damage. Damage such as cracks, cuts, stretching, contamination, and chafing can result in a breakdown of the insulation material, thereby exposing the conductor. While such damage is considered serious and would demand a repair, in many cases it can go undetected. An exposed conductor can exist indefinitely with little or no adverse effect on aircraft performance. It is only when the exposed conductor is "shorted" that an arcing event occurs.

Notwithstanding the special attention that is paid to the design, installation, and maintenance of aircraft wiring systems, wiring irregularities can develop in any aircraft. On 22 December 1998 the TSB issued Aviation Safety Advisory 980031-1, which detailed various MD-11 wiring anomalies discovered during many aircraft inspections. These anomalies included the following: chafed, cracked, broken, or cut electrical and bonding wires; inconsistencies in the routing of wires and wire bundles; loose terminal connections; excessively small wire bend radii; and unsealed electrical wire conduits. Subsequently, the FAA issued many wire-related airworthiness directives (for various aircraft, including the MD-11) as part of its MD-11 Wiring Corrective Action Plan.

Additionally, the FAA commissioned a Transport Aircraft Intrusive Inspection Project as part of its Aging Transport Systems Rulemaking Advisory Committee. This project inspected six recently retired transport category aircraft from a variety of manufacturers and operators. The study discovered wires degraded through poor repairs or splices, heat-damaged or burnt wire, vibration damage or chafing, cracked insulation, arcing, and insulation delamination.^{Footnote 39} The report concludes that there are risks associated with uncorrected degenerative conditions, and recommends options for prevention or mitigation of such failures. While increasing the frequency and quality of maintenance inspections is a viable option, since most of the wiring system is bundled and located in hidden or inaccessible areas, it is difficult to monitor the health of an aircraft's wiring system during scheduled maintenance with existing equipment and procedures. Therefore, it is realistic to expect that until wire maintenance inspection equipment and methods are perfected, wire failures that could result in fire ignition will continue to occur.

The electrical protection of an aircraft's wiring system is provided by a variety of circuit protective devices. The most common of these are circuit breakers, which are designed to protect the electrical distribution system—the wires—from an electrical overload. However, circuit breakers have design limitations. An overload caused by a wire failure may not lead the circuit breaker to de-energize the circuit; this may create high heat and a potential ignition. While ongoing R&D seeks to improve circuit protection devices, at this time there are portions of aircraft wiring systems that may not be protected against all electrical overload conditions.

Irrespective of efforts to design, install and maintain an aircraft's wiring system to a high standard, deficiencies with wires will likely persist and present the potential for wire failures. While all wires will arc under certain circumstances, the dynamics of how a particular wire fails during an arcing event is highly dependant on the composition of the wire insulation.^{Footnote 40} Understanding the dynamics of how a wire will fail under realistic conditions would be valuable, given the known consequences of the failure of an energized wire. While the FAA endorses several failure tests (for example, the dry arc tracking test procedure), it does not require any failure tests as a basis for wire certification.

The Board believes that, given the incidence of aircraft wire failures and their role as potential ignition sources, the absence of a certification requirement that measures a wire's failure characteristics, and that specifies performance standards under realistic operating conditions, constitutes a risk. Therefore, the Board recommends that:

System evaluation: Fire hardening considerations

Various materials, including endcaps from both the oxygen and air conditioning systems used in the MD-11, have exhibited less-than-ideal fire propagation characteristics as described in Appendix A. The premature failure of either the aluminium endcap used in the crew oxygen system, or the elastomeric endcaps used on ducts within the air conditioning system, would likely have exacerbated the in-flight fire on board SR 111. Under current regulations, a material's intended location and application must be identified in order to define which fire tests are required for that material's certification. If a material is to be used in a designated fire zone (e.g., the engine compartment) it must be hardened to withstand the more rigorous conditions associated with that environment and so delay a failure that might contribute to a fire in progress.^{Footnote 41} In most other areas of the aircraft, there is no requirement to determine if a material's failure would exacerbate a fire in progress. Yet the selection of inappropriate materials may lead to premature breaches of certain systems—such as oxygen, hydraulic, wiring, and air environmental—which could exacerbate an in-flight fire.

It is an established aviation industry practice to consider the consequences of a system's failure during the certification process. FAR 25.1309 requires that a system safety analysis be conducted as part of a system's certification process. The purpose of such an analysis is to confirm that the system has been designed and installed using a fail-safe methodology.^{Footnote 42} This approach ensures that equipment failures will not have any adverse effect on an aircraft's safe flight and landing. Typically, this analysis does not include an assessment of the consequences of the system's failure as a result of fire. For example, the certification of oxygen systems whose design includes materials with dissimilar properties, without consideration for how this arrangement would affect the integrity of the system when it is exposed to a fire, may allow a latent failure to persist. Similarly, where an air conditioning duct system is made of dissimilar materials (such as aluminium ducts with elastomeric endcaps), an in-flight fire may cause an elastomeric endcap to fail before the aluminium portion of the same duct system. This failure of the endcap material would introduce forced air into a fire in progress and would have the potential to aggravate the fire. Assessing the impact of a system's failure when exposed to fire, and designing aircraft systems to delay failures that could seriously aggravate an in-flight fire, would provide an additional defence in limiting the size and progress of in-flight fires.

The Board believes that a fire-induced material failure in some aircraft systems has the potential to augment the combustion process and exacerbate the consequences of an in-flight fire. Therefore, the Board recommends that:

As the investigation proceeds, should the Board identify additional safety deficiencies in need of urgent attention, it will make further aviation safety recommendations.

Benoît Bouchard
Chairperson
On behalf of the Board

Appendix A

Flammability testing done as part of the A98H0003 investigation has revealed that some certified materials used in the MD-11 exhibit less-than-ideal fire propagation characteristics:

• Hook-and-Loop Fastener System: This material is a lightweight fastener system that is employed in a variety of applications throughout the aircraft. It is used in both occupied and remote areas of the aircraft. No documentation has been discovered to indicate exactly what certification testing was used to approve this material. Subsequent testing by the TSB and the FAA discovered that this material demonstrated unacceptable flame propagation characteristics when tested alone or when used as part of a typical thin-film thermal acoustic insulation material installation.
• Elastomeric Material: Such materials are made from various polymers and have the elastic properties of natural rubber. Amongst other applications, elastomeric materials are used on the MD-11 to cap unused duct openings in the air conditioning system. While no certification documents have been discovered, Appendix F to Part 25 Part I of the FARs requires that such elastomeric material be tested in accordance with the horizontal Bunsen burner test. TSB/FAA testing has revealed that although the material passes the horizontal test, when tested using the vertical Bunsen burner test it was a qualified "failure".
  Initially, when samples of elastomeric endcap material were tested using the vertical Bunsen burner test they glowed rather than flamed. The material would be considered compliant as the test criteria allow for the material to glow and still pass the test. However, when the test was allowed to continue, the glowing material eventually burst into flame, which entirely consumed the material.
• Aluminium Endcaps: The original oxygen line installation on the MD-11 was constructed entirely of aluminium tubing. The system included a "capped" line designed for use in a different configuration of the MD-11. Due to installation difficulties encountered during aircraft manufacture, the original aircraft manufacturer replaced the aluminium with a steel line during aircraft production. For undetermined reasons, the aluminium endcap was not replaced by a steel one at this time. Concerned about how this heterogeneous configuration would behave during a high-temperature event, the TSB conducted several experiments. During the testing, the system leaked, and in some instances the endcap failed completely, allowing a free flow of oxygen. Such an oxygen leak during an in-flight fire might be catastrophic.
• Insulation Blanket Tape: Some thin-film thermal acoustic insulation blanket constructions require the use of adhesive tape. Typically, the tape is made of a material similar to that of the blanket cover. During manufacture, although the blanket cover material was required to pass the vertical Bunsen burner test, no flammability testing was required for the Douglas Material Specification 1984, Type 4 tape used on the accident aircraft. Subsequent fire testing conducted by the TSB and the FAA has discovered that this type of tape exhibits unacceptable fire propagation characteristics.
• Polyethylene Foam: Such materials are used for a variety of applications throughout the aircraft, in many different shapes and sizes. In preliminary testing on some examples of this type of material, it has demonstrated a tendency to propagate flame. No certification documentation has been discovered that would indicate how these materials were certified. To fully characterize the material's flammability properties, further testing is anticipated.
• Composite Ducts: Parts of the accident aircraft's air conditioning system located in the area of heavy fire damage were constructed of composite material. The investigation is interested in determining which flammability tests were conducted on this material during the certification process. The TSB and FAA are planning fire tests to determine this material's flammability properties.

Appendix B

Synopses of aircraft fires in which cockpit visibility was a factor:

• 18 January 1990: The cockpit of an MD-80 was filled with smoke from overheated electrical wire insulation. The left generator phase B power feeder cable terminal had melted from intense arcing. Additionally, smoke was generated when the molten metal sprayed and ignited adjacent material. (United States National Transportation Safety Board)
• 16 October 1993: In an MD-81, after levelling at flight level 180, smoke from an electrical source entered the cockpit from behind the overhead panel. Shortly thereafter, the smoke became so dense that the pilots were unable to read emergency checklists or the instrument approach procedures. Investigators determined that the smoke was caused by a massive smoldering fire involving the emergency power switch. (Aircraft Accident Investigation Bureau, Germany)
• 08 August 2000: A DC-9 experienced an in-flight fire in which the captain and first officer noticed a smell of smoke shortly after takeoff. The crew immediately donned oxygen masks and smoke goggles. The smoke became very dense and restricted the crew's ability to see either the cockpit instruments or the visual references outside the aircraft. Investigation found extensive heat damage to wires and insulation in the electrical panel behind the captain's seat. The heat was sufficient to blister the primer on the fuselage crown skin. (United States National Transportation Safety Board)
• 01 October 2000: An MD-80 experienced an electrical fire approximately 15 minutes into the flight, the cockpit filled with smoke and a loud popping sound was heard accompanied by sparks from the jump seat area. The examination of the aircraft disclosed a 2 by 1 1/2 inch fire-damaged hole in the left jump seat wall. Several heavy-gauge electrical wires were welded together on the opposite side of the wall. There were also four 50-ampere circuit breakers popped on the left circuit breaker panel behind the pilot's seat. (United States National Transportation Safety Board)

Appendix C

Heat release

Heat release is a measure of the amount of heat emitted by a burning material. How quickly a fire reaches flashover depends on the rate of heat release of the combustibles involved. Certain materials used in the occupied areas of the cabin must demonstrate that they will not exceed a specified maximum heat release rate and maximum total heat release. The purpose of this requirement is to delay the onset of flashover during a post-crash fire, as there is a direct correlation between a material's heat release and its contribution to the onset of flashover. In contrast, much of the flammable material that is likely to be involved in an in-flight fire is located in remote areas, such as "attic" spaces. Airflow considerations aside, compartments within aircraft can promote the accumulation of hot gases and combustion by-products, thereby creating conditions conducive to flashover.

Under existing regulations, materials other than selected cabin materials are not required to pass any heat-release test. The inference is that delaying flashover in the event of a fire in these unoccupied locations is not viewed by regulatory authorities as a safety improvement requiring additional regulation. Requiring all materials to meet a heat-release standard would provide an increased resistance to flashover and benefits comparable to those currently applicable to selected cabin materials. The Board has concerns about the lack of broader standards to limit the amount of heat that would potentially be released by burning materials within aircraft; it believes that the associated risks could be mitigated by eliminating the use of materials that sustain or propagate fire.

Smoke generation

Material smoke-generation requirements are designed to measure the amount of smoke emitted by burning materials. The primary objective in limiting smoke generation is to maintain visibility for egress during a post-crash fire. Therefore, smoke tests are typically only required for selected materials used in occupied areas of the cabin. There is no smoke test requirement for the majority of materials in the rest of the aircraft. In-flight fires, examples of which are contained in Appendix B, indicate that smoke will migrate to the occupied areas of the aircraft and can impede the crew's ability to effectively deal with such an emergency. The effect, on the passengers, from prolonged exposure to smoke generated during an otherwise survivable in-flight fire event is largely unknown. As there are presently no provisions designed to isolate passengers from such smoke, reduced visibility during ensuing ground evacuations can be anticipated. Establishing a certification standard limiting smoke generation for all aircraft materials would increase visibility and survivability.

The Board has concerns about the lack of standards regarding smoke generation associated with burning aircraft materials; it believes that the smoke-related risks could be mitigated through the elimination of materials that sustain or propagate fire.

Toxicity

Materials designated for use in aircraft are not required, by regulation, to meet any toxicity standards, although manufacturers can impose toxicity criteria of their own. Regulatory requirements and strategies have focussed on improving the chances of passenger survival in the event of a post-crash fire. This is accomplished by mandating that selected cabin materials meet heat-release standards that delay the onset of flashover. This approach reflects the belief that a material's toxic effects will not be a factor until after flashover. As the flashover phenomenon is generally considered a non-survivable event, the argument is made that there is limited benefit in establishing a toxicity standard for burning materials. The physiological effects of inhaling the toxic by-products likely to be present in a post-crash fire prior to flashover, on a passenger's ability to evacuate the aircraft, are considered minimal. However, passenger evacuation is not an option in an in-flight fire. While the flight crew may be able to take limited measures to evacuate some smoke from the cabin, aircraft occupants must cope with the potentially debilitating effects of toxic and irritant gases emitted by burning aircraft materials.

As discussed in the TSB's aviation safety recommendations A00-16 to A00-20, a crew has only a limited ability to effectively assess and suppress such hidden, inaccessible fires. Therefore, in its incipient stages, the most likely in-flight fire scenario would involve an uncontrolled fire comprising known flammable materials. As there are no mandated toxicity criteria for materials used within aircraft, some of these materials are likely toxic when burned. Such toxic by-products would be spread by the air circulation within the pressurized hull and could eventually impair crew and passengers. While it can be argued that the crew are equipped with breathing apparatus that allows them to continue to function, passengers have no such equipment. The passenger oxygen delivery system is designed to be used in a depressurization event and will not protect the user against smoke or airborne toxins. In fact, the MD-11 Aircraft Operations Manual warns that passenger oxygen masks must not be released below 14 000 feet when smoke or an abnormal heat source is present, as the oxygen may increase the possibility or severity of a cabin fire.^{Footnote 43}

Some in-flight fires have been resolved with minimal on-board firefighting coupled with immediate action to land the aircraft (with flight crew smoke masks donned). However, immediate access to an emergency airport may not always be an option, such as during a transoceanic flight. In such cases, passengers could suffer from prolonged exposure to combustion by-products with an unknown effect on their ability to survive. The Board has concerns about the lack of standards to limit the amount of toxic emissions that would potentially be released by burning materials within an aircraft. It believes that the associated risks could be mitigated by eliminating the use of materials that sustain or propagate fire.

Appendix D

Synopses of several occurrences in which aircraft wiring was a factor:

• 24 November 1993: An MD-87 was taxiing when smoke was detected in the cabin. A fire subsequently erupted and destroyed the aft cabin interior. Investigators concluded that two chafed wires suffered metal-to-metal contact with the frame, igniting surrounding material. (United States National Transportation Safety Board)
• 17 July 1996: A Boeing 747 experienced an in-flight breakup. Investigators found that the breakup was caused by an overpressure event in the centre wing tank. This overpressure was the result of a Jet A fuel/air vapour explosion. The investigation concluded that the most likely ignition event was a short circuit outside of the centre wing fuel tank that entered the tank through electrical wire associated with the fuel quantity indication system. (United States National Transportation Safety Board)
• 28 November 1998: A Boeing 747 returned to its departure airport after an apparent fault associated with an electrical and electronic equipment (E&E) compartment cooling system ground exhaust valve. Investigators discovered several arced wires in a small wire bundle associated with the exhaust valve. Insulation blanket cover material had subsequently ignited and was consumed by fire. (Air Accidents Investigation Branch, United Kingdom)
• 22 December 1998: A Lockheed L-1011 experienced electrical wire arcing inside an avionics compartment where a wire bundle had sustained wire-to-wire arcing. The wire bundles were also saturated with fluid. (United States National Transportation Safety Board)
• 29 March 1999: Maintenance personnel discovered evidence of a fire on board an MD-11 while inspecting the aft floorboards during a maintenance check. Inspection revealed that a wire bundle had arced to the aircraft frame and ignited the surrounding thermal acoustic insulation material. The insulation cover material had entirely burned away. (United States National Transportation Safety Board)
• 29 December 2000: A Lockheed L-1011 experienced an electrical fire forward of the flight engineer's station in which an arc was observed at the location of the windshield heat wire bundle above the first officer's side window. Examination of the affected wires revealed electrical arcing had occurred between the aircraft structure, a clamp, and a 30-wire bundle, in which 20 wires were burned. (United States National Transportation Safety Board)
• 10 January 2001: A Boeing 767 landed in foggy conditions at Salt Lake City, Utah. At or shortly after touchdown, several circuit breakers popped, an electrical wire bundle in the E&E bay shorted out, and a small fire broke out causing smoke in the cockpit. The aircraft taxied to the gate uneventfully, and the smoke stopped when the engines were shut down. (United States National Transportation Safety Board)

MD-11 wiring (980031-1)

Place du Centre
200 Promenade du Portage
4^th Floor
Hull, Quebec
615-980031
K1A 1K8

22 December 1998

Mr. Bernard Loeb
National Transportation Safety Board
Director, Office of Aviation Safety
490 L'Enfant Plaza East S.W.
Washington, DC 20594

(through)

Mr. Jerome Frechette, Accredited Representative of the United States
to the Swissair 111 Investigation

Re: Aviation Safety Advisory 980031-1

MD-11 Wiring

Dear Mr. Loeb:

Last week your Accredited Representative and advisors from the United States met with others from the Transportation Safety Board of Canada (TSB) Swissair 111 investigation team in Halifax to share information about the progress of the investigation and to plan the next phase of the work. Of particular interest to the entire team was information about the initiation and spread of the in-flight fire, and any related safety deficiencies which may exist with the aircraft's electrical systems and associated wiring.

While the full extent of any safety deficiencies and the associated risks in these areas are not yet clearly understood, it is desirable to summarize at this point the investigation team's understanding of the problems and the initiatives that have already been taken to address them. It is the TSB's normal practice to refer safety advisories of this nature to the Canadian Department of Transport for whatever action it may deem necessary; however, since the potential safety ramifications are currently confined to the Boeing/McDonnell Douglas manufactured MD-11 fleet, it would be more appropriate at this time to provide this information directly to you as representative of the State of Manufacture.

I would like to preface these technical discussions by saying how pleased the TSB is with the outstanding support that your Accredited Representative and advisors from the United States have provided to this investigation; we are equally indebted to the team from Switzerland. I think it would be fair to say that the level of international cooperation displayed on this particular investigation has been gratifying.

The circumstances of the accident are now well known. On 2 September 1998, a Swissair McDonnell Douglas MD-11 (serial number 48448), HB-IWF, departed John F. Kennedy airport in Jamaica, New York, at 2118 hours Atlantic daylight saving time, en route to Geneva, Switzerland. Approximately 53 minutes after take-off, as the aircraft was cruising at Flight Level 330, the crew noticed an unusual smell in the cockpit. Three and a half minutes later, the crew declared a "PAN PAN PAN" and advised the Air Traffic Services (ATS) controller of smoke in the cockpit and requested a diversion. About 11 minutes thereafter, the situation had deteriorated to the point that electrical systems were being significantly affected and the crew declared an "emergency" to ATS. About six and one-half minutes later, at approximately 2231 hours, the aircraft crashed into the Atlantic Ocean near Peggy's Cove, Nova Scotia, Canada. All 215 passengers and 14 crew members suffered fatal injuries. The TSB investigation is ongoing.

Early in the work of the Systems Group, the aircraft wiring became one of the significant focuses of the technical investigation. To date, there is evidence of considerable heat damage to the aircraft ceiling areas both forward and aft of the cockpit bulkhead. This damage is consistent with the effects of a fire in those areas; the initiating source of the fire is not known. It is well known that electrical arcing can result from the breakdown of wire insulation material, and that arcing can create substantial heat. Wire insulation is susceptible to deterioration in the presence of adverse conditions, such as some combination of vibration, moisture, temperature, stress/strain, contact with rough surfaces, excessively tight bending or other physical damage.

The investigation team has recovered several electrical wires from the accident aircraft that show signs of arcing, along with various other wires that display differing degrees of heat damage, such as insulation that is discoloured, charred, or embrittled. While some of these wires belong to an entertainment system installation that is unique to Swissair aircraft, other heat-damaged wires are common to the MD-11 fleet.

TSB investigators have recovered two electrical bus feed wires from HB-IWF that are identified as the Left AC Emergency Bus Feed Wire (B205-1-10) and the Left DC Emergency Bus Feed Wire (B205-4-6); they both show signs of electrical arcing. The arc-damaged section of these wires is located approximately two inches outside the right-hand side of the overhead circuit breaker panel in the cockpit, where wires enter what is called the "tub." A few other wires that are identified as original aircraft wiring show evidence of arcing, but could not be further identified or physically located within the aircraft because the identifying insulation covers are missing. Various other wires from the ceiling area exhibit heat damage ranging from slight discolouration to heavy charring and embrittlement of the wire insulation. Additionally, a number of power-supply wires from the entertainment system exhibit arcing damage; immediately following those discoveries, Swissair voluntarily disconnected the in-flight entertainment system as a precautionary measure.

The discovery of the heat-damaged wires from the Swissair 111 aircraft prompted an examination of the wiring in a number of other MD-11s to help identify potential areas of arcing or other sources of heat generation. TSB investigators visited two maintenance facilities and examined several MD-11 aircraft. These examinations concentrated on the area from the cockpit back through to station 600, and the following anomalies were discovered:

• The forward cabin drop-ceiling area, above both the 1L and 1R doors, displayed evidence of chafed and cut wires.
• The cockpit overhead circuit breaker panel, in the vicinity of where wire bundles enter the "tub," showed several wires that exhibited light chafing of the wire insulation top coat.
• Various examples of damaged, cracked, or chafed wires were found.
• There were broken bonding wires and wires exhibiting bending radii that were smaller than manufacturers' specification.
• Wire terminal connections were found insufficiently torqued.
• There were inconsistencies in the routing of wires and wire bundles.
• Electrical conduits between the cockpit and cabin were unsealed.
• Smoke barriers between the cockpit and the cabin were open.
• The location of the emergency-light battery pack at the cockpit door entrance was inconsistent.

American advisors on your team were informed of these various anomalies as soon as they became known and there have already been prompt actions taken within the United States to address some of the issues. The Federal Aviation Administration (FAA) has released Airworthiness Directive (AD 98-25-11) requiring a one-time inspection above the 1L and 1R doors to address the wire chafing issue brought to light during this investigation. The Boeing Aircraft Company - Long Beach Division have created two MD-11 Alert Service Bulletins (ASB), MD-24A068 Revision 1 and MD-25A194 Revision 4, which address the specific discrepancies noted over the 1L and 1R door areas. These prompt actions by the FAA and Boeing were prudent, and the results of the inspections should improve the Swissair 111 team's understanding of the nature and scope of any wiring safety deficiencies.

The TSB investigation team has not established a direct relationship between the wiring discrepancies discovered in the in-service MD-11s that were recently inspected and the damaged wire from the Swissair 111 wreckage. However, given the fact that several instances of wire discrepancies were discovered at two separate MD-11 maintenance facilities, questions arise about how widespread these phenomena might be within the MD-11 fleet. In conjunction with The Boeing Company, SR Technics, on behalf of Swissair, has voluntarily developed and completed an Engineering Order which defines a comprehensive examination of the wiring in the forward areas of the Swissair MD-11 aircraft. The TSB commends this pro-active effort.

Although the full scope of any wiring safety deficiencies and the risks posed to the MD-11 fleet worldwide are not known, it may nonetheless be timely for the NTSB and the United States regulatory authority to take stock of these various preliminary findings and the specific safety actions taken. Following this review, you may decide that the situation warrants a more comprehensive look at the state of the wiring in the existing MD-11 fleet, and perhaps other aircraft fleets.

The TSB investigation team led by Mr. Gerden will, of course, continue to work closely with your representative and advisors and your Swiss counterparts; I would appreciate hearing of any actions planned as a result of this Safety Advisory.

Yours sincerely,

J.L. Maxwell Director,
Investigations (Air)

c.c.

• Mr. John Overney - Accredited Representative for Switzerland
  Aircraft Accidents Investigation Bureau
  Bahnholfplatz 10 B
  CH -3003 Berne, Switzerland
• Mr. J. C. Montplaisir
  Transport Canada Minister's Observer
  Heritage Court, 95 Foundry St.
  P.O. Box 42, Moncton, NB E1C 8K6
• Mr. Bob Henley - Air Safety Investigator - FAA
  FAA Headquarters
  800 Independence Ave., S.W.
  Washington, DC 20591

MD-11 flight crew reading light (map light) installations (A000008-1)

Place du Centre
200 Promenade du Portage
4^th Floor
Hull, Quebec
K1A 1K8

02 March 2000

Dr. Bernard Loeb
Director, Office of Aviation Safety
National Transportation Safety Board
490 L'Enfant Plaza East S.W.
Washington, DC 20594

(through)

Mr. Frank Hildrup, Accredited Representative of the United States
to the Swissair 111 Investigation

Re: Aviation Safety Advisory A000008-1

MD-11 flight crew reading light (map light) installations

Dear Dr. Loeb:

Last month the Accredited Representatives and advisors from the United States and Switzerland met with others from the Transportation Safety Board of Canada (TSB) Swissair 111 investigation team in Halifax to share information about the progress of the investigation and to plan the next phase of the work. Of ongoing interest to the team is the identification of any potential sources of heat in the proximity of fuels that may support ignition. In this regard, information has recently come to light regarding a potential safety deficiency associated with the flight crew reading light (usually referred to as a map light) installations^{Footnote 44} on MD-11 aircraft.

It is the TSB's normal practice to refer Safety Advisory Letters of this nature to the Canadian Department of Transport for whatever action it may deem necessary; however, since the potential safety ramifications are currently confined to the Boeing/McDonnell Douglas manufactured MD-11 fleet, it would be more appropriate at this time to provide this information directly to you as the representatives of the State of Manufacture.

The circumstances of the accident are now well known. On 2 September 1998, a Swissair McDonnell Douglas MD-11 (serial number 48448), HB-IWF, departed John F. Kennedy airport in Jamaica, New York, at 2118 Atlantic daylight saving time, en route to Geneva, Switzerland. Approximately 53 minutes after take-off, as the aircraft was cruising at Flight Level 330, the crew noticed an unusual smell in the cockpit. Three and a half minutes later, the crew declared a "PAN PAN PAN" and advised the Air Traffic Services (ATS) controller of smoke in the cockpit and requested a diversion. About 11 minutes thereafter, the situation had deteriorated to the point that electrical systems were being significantly affected and the crew declared an "emergency" to ATS. About six and a half minutes later, at approximately 2231, the aircraft crashed into the Atlantic Ocean near Peggy's Cove, Nova Scotia, Canada. All 215 passengers and 14 crew members suffered fatal injuries. The TSB investigation is ongoing.

As part of its continuing investigation into the causes, contributing factors, and potential safety issues highlighted by the Swissair Flight 111 accident, the TSB issued Interim Air Safety Recommendations A99-07 and A99-08 on 11 August 1999. These recommendations addressed safety deficiencies in both the flammability characteristics of the metallized polyethylene teraphthalate (MPET) covered insulation blankets and the flammability test criteria required under Federal Aviation Regulations (FAR) 25.853. Subsequently, the Federal Aviation Administration issued a Notice of Proposed Rulemaking^{Footnote 45} (NPRM), which would require, if adopted as written, the total removal of MPET-covered insulation blankets from all U.S.-registered MD-11 aircraft within four years of the effective date of any consequent Airworthiness Directive (AD). The NPRM raised the concern that MPET-covered insulation blankets may contribute to the propagation of a fire when ignition occurs from small ignition sources such as electrical arcing or sparking. At the time of this writing, an AD has not yet been finalized in connection with this proposal.

Subsequent to the TSB's recommendations, an MD-11 operator took a pro-active approach and initiated a blanket replacement program to remove the MPET-covered insulation material from the cockpit, the forward galley area, and the centre accessory compartment. As the blanket replacement procedure required the temporary re-positioning of numerous electrical wire bundles in these areas, a wiring inspection was also conducted to ensure the wires were not damaged during this process.

The TSB arranged for the blanket replacement procedure to be monitored in order to assess if any collateral damage occurred to the wiring and inspect for any anomalies. During one of the early inspections it was noted that an insulation blanket was in contact with the upper part of the recessed map light installed on the right side of the cockpit ceiling. The MPET-covered insulation material had been mechanically damaged and, due to continuous contact, had been imprinted with the back of the map light fixture, which houses a halogen lamp. Also, one of the ring terminal insulators attached to a wire lead to the map light exhibited possible heat damage. Examination of the left map light found similar but lesser damage. No damage was reported at the observer station map light installations.

Based on the above observations, about a dozen MD-11 aircraft from two operators were inspected. The discrepancies that were discovered included the following:

• Several map lights exhibited cracks in the plastic-like protective covers located over the top of the positive terminal of the lamp.
• On some of the lights, it was evident that these cracks had been repaired.^{Footnote 46}
• In one instance, the cover that is normally located on the top of the positive terminal was partially missing and the positive terminal strip exhibited melting/arcing damage.
• On a number of map lights, the insulating material covering the ring terminal connectors also exhibited heat deformation.
• The MPET-covered insulation material was found pressed against the back of many of the fixtures. The damage to the metallized mylar insulation blankets appeared to be the result of mechanical and thermic effects of the map light.

The TSB investigation regarding the condition of these map light installations continues to assess the extent of the deficiency. Although the full scope of this deficiency and the risks posed to the MD-11 fleet worldwide are not known, in light of the identified flammability risks associated with MPET-covered insulation blankets, it may be timely for the NTSB and the United States' regulatory authority to take stock of these preliminary findings. Following this review, you may decide that the situation warrants a more comprehensive assessment of the state of the map light installations in the existing MD-11 fleet, and perhaps other aircraft fleets as appropriate.

The TSB investigation team led by Mr. Gerden will, of course, continue to work closely with your representative and advisors and your Swiss counterparts; I would appreciate hearing of any actions planned as a result of this Safety Advisory.

Yours sincerely,

William T. Tucker
Director General
Investigation Operations

c.c.

• Mr. John Overney - Accredited Representative for Switzerland
  Aircraft Accident Investigation Bureau
  Bahnholfplatz 10 B
  CH -3003 Berne, Switzerland
• Mr. G. Michael Doiron
  Transport Canada Minister's Observer
  Heritage Court, 95 Foundry St.
  P.O. Box 42, Moncton, NB E1C 8K6
• Mr. Bob Henley - Air Safety Investigator - FAA
  FAA Headquarters
  800 Independence Ave., S.W.
  Washington, DC 20591, U.S.A.
• Mr. Andre Auer - Director
  Federal Office for Civil Aviation
  Maulbeerstrasse 9
  CH-3003 Berne, Switzerland

Controller knowledge of flight crew emergency procedures (A010020-1)

Place du Centre
200 Promenade du Portage
4^th Floor
Hull, Quebec K1A 1K8

825-A98H0003
615-A010020-1

14 August 2001

Transport Canada

Louise Laflamme
Director, TSB Liaison Branch
330 Sparks Street, 12^th Floor
Ottawa, Ontario
K1A 0N5

Re: AMENDED AVIATION SAFETY ADVISORY A010020-1 (A98H0003)
Controller Knowledge of Flight Crew Emergency Procedures

Dear Ms. Laflamme:

On 02 September 1998, at 2211 Atlantic daylight time, the flight crew of Swissair flight 111 (SR 111), a McDonnell Douglas MD-11 cruising at flight level 330 en route from John F. Kennedy (JFK) International Airport, New York, to Geneva, Switzerland, noticed an unusual smell in the cockpit. About three and a half minutes later, the flight crew declared a "Pan, Pan, Pan" with Moncton air traffic control (ATC) indicating that they had smoke in the cockpit. They initially requested a diversion to Boston, then decided to divert to Halifax International Airport, Nova Scotia, which was closer. The Moncton controller cleared the flight to the Halifax airport, which was 57 miles away, and handed the flight over to the Halifax Terminal controller.

About six minutes after that handover, or about ten minutes after the flight crew declared the "Pan, Pan, Pan," the situation in the cockpit began to deteriorate rapidly. The autopilot disconnected and the aircraft's flight data recorder began to record a rapid succession of anomalies that reflected failures related to various aircraft systems. The flight crew declared an emergency, and indicated that they were starting to dump fuel and needed to land immediately. Thereafter, no further radio communications were established with SR 111, although the controller transmitted a clearance to the aircraft to begin dumping fuel. When there was no response from the aircraft, the controller again cleared the flight to dump fuel. Secondary radar contact with the aircraft was then lost, while the aircraft was in level flight at about 10 000 feet above sea level. About six minutes later, at approximately 0131 UTC, the aircraft crashed into the Atlantic Ocean near Peggy's Cove, Nova Scotia. All 215 passengers and 14 crew members suffered fatal injuries. No further radio transmissions to SR 111 were made by the controller and none were heard from SR 111 during that last six minutes. An on-board fire is believed to have rendered inoperative some aircraft systems, including the communications systems, during the latter portion of the flight. TSB investigation A98H0003 is ongoing.

The investigation found that there are controllers who believe that flight crews might turn off some aircraft electrical and radio systems during fuel dumping operations, for reasons of safety. This misconception was used by ATS controllers to rationalize the cessation of radio communications and secondary radar information that occurred immediately after the crew had indicated that they were starting to dump fuel.

Since 1998 the TSB has recorded about 200 occurrences per year in which aircraft required emergency and/or priority services of air traffic control in Canada. Emergencies are not common, given the large number of aircraft movements that take place annually in Canada without mishap. Nevertheless, in emergency situations the potential to minimize undesirable outcomes and enhance the service provided to flight crews could depend, in part, on controllers' awareness of the ramifications of special or emergency procedures conducted by those flight crews. Controllers' knowledge of flight crew expectations, and basic familiarity with the capabilities of commercial aircraft, could enhance their awareness of flight crews' operational needs.

Prior to this occurrence there had been little information provided to controllers, during either basic or continuation training, regarding the basic capabilities and limitations of aircraft or about typical procedures practiced by flight crews during urgency or distress situations. There is no regulatory requirement for controllers in Canada to receive special training in the handling of aircraft emergencies, during ab initio or refresher training.

There is no implication that the controller's actions affected the outcome of the occurrence. Nevertheless, following the occurrence Nav Canada acted quickly to augment controllers' knowledge regarding emergency scenarios, by voluntarily initiating a one-time, comprehensive, mandatory "Emergency Preparedness and Response" training course. The refresher program includes contingency planning in the event of radar, communication, or power failure, and aircraft emergencies. It focuses on group discussion and interaction with subject-matter experts. Area and terminal controllers are provided with simulator practice and the opportunity for skill development. The curriculum is being administered to all Nav Canada qualified air traffic controllers during a two-year period ending in August 2001. While Nav Canada has taken these positive steps to educate current qualified controllers, there is no provision to continue to educate controller trainees qualifying after August 2001, to educate non-Nav Canada controllers, or to periodically update qualified controllers regarding the changes in cockpit procedures and aircraft technology that might be relevant to controllers.

Recognition of a need, and advancements in controller knowledge and training regarding various aspects of controller handling of aircraft during emergencies, have been made in some other jurisdictions. The British Aircraft Accident Investigation Board (AAIB), in their accident report concerning a BAC One-eleven, G-BJRT, over Didcot, Oxfordshire, United Kingdom (UK), on 10 June 1990, stated that the provision of training to controllers in the handling of emergencies and other infrequent occurrences is considered to be essential. The AAIB recommended to the Civil Aviation Authority (CAA) of the UK that prior to the issuance of an ATC rating, a candidate shall undergo an approved course that includes training in both theoretical and practical handling of emergency situations. This training should then be enhanced at the validation stage and later by regular continuation and refresher exercises.

The CAA accepted this recommendation and implemented mandatory emergency continuation training for controllers in January 1996.

Also, the Flight Safety Foundation published a series of recommendations stemming from its Approach and Landing Accident Reduction (ALAR) task force. A sub-group of the ALAR task force was the ATC Training and Procedures task group. Their report offered the following recommendations, which refer to ATC controller training:

ATC should introduce programs that involve controllers and pilots, to:

Promote mutual understanding of each other's procedures, instruction, operational requirements, and limitations;

Improve controller's knowledge of the capabilities and limitations of advanced-technology flight decks;

Foster improved communication and task management by pilots and controllers during emergency situations;

Implement procedures that require immediate clarification/verification by a controller if communication from a pilot indicates a possible emergency;

Implement procedures for ATC handling of aircraft in emergency situations to minimize pilot distraction.

Transport Canada may wish to review controller training requirements to consider the need for additional training regarding aircraft emergency scenarios prior to the initial issuance of an ATC licence to air traffic controllers under the Canadian Aviation Regulations. Specifically, further training may be warranted that provides the requisite knowledge and skills so that controllers are better able to provide safe and expeditious air traffic control services to aircraft that are experiencing emergency or distress conditions. The need for regular continuation training and refresher exercises regarding emergency scenarios should also be considered.

Sincerely,

Daniel Verreault, P.Eng
Director, Air Investigations

cc.

• Mr. John Crichton, President and CEO, Nav Canada
• Mr. Phil Cutts, President, SerCo Facilities Management Inc.

MD-11 standby (secondary) instruments (A010042-1)

Place du Centre
4^th Floor
200 Promenade du Portage
Hull, Quebec
K1A 1K8

615-A010042-1
825-A98H0003

28 September 2001

Ms. Louise Laflamme
Director, TSB Liaison Branch
Safety and Security
Transport Canada - Aviation
Place de Ville, 12^th Floor
Tower C, 330 Sparks Street
Ottawa, Ontario
K0A 0N5

Re: AVIATION SAFETY ADVISORY A010042-1 (A98H0003)
MD-11 STANDBY(SECONDARY) INSTRUMENTS

Dear Ms. Laflamme:

On 02 September 1998, at 2211 Atlantic daylight time (ADT^{Footnote 47} the flight crew of Swissair flight 111 (SR 111), a McDonnell Douglas MD-11 cruising at flight level 330 en route from John F. Kennedy (JFK) International Airport, New York, to Geneva, Switzerland, noticed an unusual smell in the cockpit. About three and a half minutes later, the flight crew declared a "Pan, Pan, Pan" with Moncton air traffic control (ATC), indicating that they had smoke in the cockpit. They initially requested a diversion to Boston, then decided to divert to Halifax International Airport, Nova Scotia, which was closer.

About 10 minutes after the flight crew declared the "Pan, Pan, Pan," the situation in the cockpit began to deteriorate rapidly. The autopilot disengaged, and various additional systems related failures occurred, some of which affected primary instrument displays. The flight crew declared an emergency, and indicated that they needed to land immediately. There are indications that standby instruments were being used. At about 2226, ATC lost communication with the aircraft, and the aircraft's transponder ceased to function. At approximately 2231, the aircraft crashed into the Atlantic Ocean near Peggy`s Cove, Nova Scotia. All 215 passengers and 14 crew members suffered fatal injuries. The investigation (A98H0003) is ongoing.

During the emergency, the workload of the flight crew was substantial. They were faced with diverting to an unfamiliar airport, at night, with smoke in the cockpit, and with oxygen masks on. It is not clear as to whether some limited primary flight information was available during the final minutes of the flight. A search of several databases indicates incidents where flight crews were forced to use standby (secondary) instruments as the sole means to obtain in-flight attitude, direction, and airspeed information are rare. However, when pilots have been forced to rely on standby instruments in emergency situations, they have noted deficiencies including: poor instrument location, inadequate size of displays, difficulty in transition from primary flight instruments, and lack of adequate training.

The Canadian Aviation Regulations (CARs) and United States Federal Aviation Regulations (FARs) stipulate the following:

For Standby Instruments

• when required by regulations CAR 605.41 and FAR 121.305, aircraft be equipped with a standby attitude indicator that is located in a position on the instrument panel where it is plainly visible to and usable by any pilot at his or her station;
• the standby attitude indicator must be powered from a source independent of the electrical generating system.

For General Instrumentation

• each flight, navigation, and powerplant instrument for use by any pilot must be plainly visible from his/her station with the minimum practicable deviation from a normal position and line of vision when looking forward along the flight path (FAR 25.1321);
• flight instruments which provide attitude, airspeed, altitude and direction of flight, be located adjacent to each other, and be grouped on the instrument panel in a specific relative layout (FAR 25.1321);
• the grouping must be such that the attitude information is in the centre, with airspeed information on the left, altitude information on the right, and direction of flight information directly below the attitude information (this type of grouping is commonly called the standard "T" layout).

When pilots are forced to use standby instruments, they must be able to quickly adjust their instrument cross-check scan. The transition to standby instruments, especially in adverse circumstances, could be significantly hampered by having the instruments positioned away from the normal line of vision, and by not having them in a standard grouping layout. The result could be disorientation of the flight crew, and loss of control of the aircraft.

In the accident aircraft, the standby instruments for attitude, altitude and airspeed were located just above the centre pedestal, below the display units. The standby direction-of-flight information was provided by the standby magnetic compass which needed to be un-stowed to be useable. It was installed at the top of the windshield on the left side of the centre post, a common location in many transport category aircraft. The location of the standby magnetic compass in relation to the other standby instruments would require a pilot to scan over a considerable vertical distance, possibly requiring an up-and-down head movement, to complete an instrument cross-check. This would increase the potential for disorientation (Coriolis illusion).

The challenge of flying using standby instruments would be even greater for flight crews who were not well trained in their use, or if they did not have recent practice. To simulate realistic scenarios, flight crews would have to be trained to use standby instruments when faced with other complicating factors such as loss of additional systems, wearing oxygen masks and goggles, and having smoke in the cockpit. The existing regulations do not require any specific training for flight crews with respect to using standby instruments.

As stated above, regulations require that the standby attitude indicator be powered from a source that is independent of the aircraft's electrical generating system. In the case of the MD-11, the standby attitude indicator is powered from the battery bus, which is independent. However, there is no requirement for standby instruments to remain powered by an independent power supply separate from the aircraft electrical system and battery. Recent technological advances have been made in the area of independent standby instrumentation, and in providing for secondary navigation and communication capability. The TSB is assessing the safety impact of having an independent standby system in aircraft, that would provide flight crews with a "get-home package" in case of total electrical failure. Another potential benefit of such a system could be that it would allow for more options when de-powering an aircraft's electrical system in a smoke/fire event.

Following the SR 111 accident, Swissair decided to modify the standby flight instrument equipment in their aircraft. For their MD-11 aircraft, they chose to install a secondary flight display system (SFDS), which has a similar layout to the primary flight display in that aircraft. It includes attitude, altitude, airspeed and heading in one integrated display. In the event of a loss of primary aircraft electrical power to the unit, it has an auxiliary battery to supply power for a minimum of 45 minutes.

Regulatory authorities and others may wish to consider reviewing the requirements for standby instrumentation, including related issues such as standby communication and navigation capabilities. The above parties may also wish to review present regulations and practices to ensure that flight crews receive adequate training in the use of standby flight instruments, and that design standards be adequate to ensure that standby instruments are grouped adjacent to each other, and have a similar relative layout as the primary flight instruments.

Yours sincerely,

Daniel Verreault, P. Eng
Director, Air Investigations

c.c.

• Jim McMenemy
  Transport Canada, Minister's Observer
• Willi Schurter
  Swiss Air 111 Post Emergency Organisation
• Pamela Rosnik
  Boeing, Boeing Propulsion Technology
• Steven Wallace
  FAA, Director of Accident Investigation
• Vikki Anderson
  FAA, Air Safety Investigator
• Jean Overney
  Swiss AAIB, Chief Inspector
• ALPA
  Jim Stewart, Air Safety Coordinator - Canada
• FOCA
  Christine Gerber, Head of Section Continuing Airworthiness Section

MD-11 standby (secondary) instruments (A010042-2)

Place du Centre
4^th Floor
200 Promenade du Portage
Hull, Quebec K1A 1K8

615-A010042-2
825-A98H0003

28 September 2001

Mr. John Clark
Director, Office of Aviation Safety
National Transportation Safety Board
490 L'Enfant Plaza East, S.W
Wahington, D.C.
U.S.A, 20594

Re: AVIATION SAFETY ADVISORY A010042-2 (A98H0003)
MD-11 STANDBY(SECONDARY) INSTRUMENTS

Dear Mr. Clark:

On 02 September 1998, at 2211 Atlantic daylight time (ADT)^{Footnote 48} the flight crew of Swissair flight 111 (SR 111), a McDonnell Douglas MD-11 cruising at flight level 330 en route from John F. Kennedy (JFK) International Airport, New York, to Geneva, Switzerland, noticed an unusual smell in the cockpit. About three and a half minutes later, the flight crew declared a "Pan, Pan, Pan" with Moncton air traffic control (ATC), indicating that they had smoke in the cockpit. They initially requested a diversion to Boston, then decided to divert to Halifax International Airport, Nova Scotia, which was closer.

About 10 minutes after the flight crew declared the "Pan, Pan, Pan," the situation in the cockpit began to deteriorate rapidly. The autopilot disengaged, and various additional systems related failures occurred, some of which affected primary instrument displays. The flight crew declared an emergency, and indicated that they needed to land immediately. There are indications that standby instruments were being used. At about 2226, ATC lost communication with the aircraft, and the aircraft's transponder ceased to function. At approximately 2231, the aircraft crashed into the Atlantic Ocean near Peggy`s Cove, Nova Scotia. All 215 passengers and 14 crew members suffered fatal injuries. The investigation (A98H0003) is ongoing.

During the emergency, the workload of the flight crew was substantial. They were faced with diverting to an unfamiliar airport, at night, with smoke in the cockpit, and with oxygen masks on. It is not clear as to whether some limited primary flight information was available during the final minutes of the flight. A search of several databases indicates incidents where flight crews were forced to use standby (secondary) instruments as the sole means to obtain in-flight attitude, direction, and airspeed information are rare. However, when pilots have been forced to rely on standby instruments in emergency situations, they have noted deficiencies including: poor instrument location, inadequate size of displays, difficulty in transition from primary flight instruments, and lack of adequate training.

The Canadian Aviation Regulations (CARs) and United States Federal Aviation Regulations (FARs) stipulate the following:

For Standby Instruments

• when required by regulations CAR 605.41 and FAR 121.305, aircraft be equipped with a standby attitude indicator that is located in a position on the instrument panel where it is plainly visible to and usable by any pilot at his or her station;
• the standby attitude indicator must be powered from a source independent of the electrical generating system.

For General Instrumentation

• each flight, navigation, and powerplant instrument for use by any pilot must be plainly visible from his/her station with the minimum practicable deviation from a normal position and line of vision when looking forward along the flight path (FAR 25.1321);
• flight instruments which provide attitude, airspeed, altitude and direction of flight, be located adjacent to each other, and be grouped on the instrument panel in a specific relative layout (FAR 25.1321);
• the grouping must be such that the attitude information is in the centre, with airspeed information on the left, altitude information on the right, and direction of flight information directly below the attitude information (this type of grouping is commonly called the standard "T" layout).

When pilots are forced to use standby instruments, they must be able to quickly adjust their instrument cross-check scan. The transition to standby instruments, especially in adverse circumstances, could be significantly hampered by having the instruments positioned away from the normal line of vision, and by not having them in a standard grouping layout. The result could be disorientation of the flight crew, and loss of control of the aircraft.

In the accident aircraft, the standby instruments for attitude, altitude and airspeed were located just above the centre pedestal, below the display units. The standby direction-of-flight information was provided by the standby magnetic compass which needed to be un-stowed to be useable. It was installed at the top of the windshield on the left side of the centre post, a common location in many transport category aircraft. The location of the standby magnetic compass in relation to the other standby instruments would require a pilot to scan over a considerable vertical distance, possibly requiring an up-and-down head movement, to complete an instrument cross-check. This would increase the potential for disorientation (Coriolis illusion).

The challenge of flying using standby instruments would be even greater for flight crews who were not well trained in their use, or if they did not have recent practice. To simulate realistic scenarios, flight crews would have to be trained to use standby instruments when faced with other complicating factors such as loss of additional systems, wearing oxygen masks and goggles, and having smoke in the cockpit. The existing regulations do not require any specific training for flight crews with respect to using standby instruments.

As stated above, regulations require that the standby attitude indicator be powered from a source that is independent of the aircraft's electrical generating system. In the case of the MD-11, the standby attitude indicator is powered from the battery bus, which is independent. However, there is no requirement for standby instruments to remain powered by an independent power supply separate from the aircraft electrical system and battery. Recent technological advances have been made in the area of independent standby instrumentation, and in providing for secondary navigation and communication capability. The TSB is assessing the safety impact of having an independent standby system in aircraft, that would provide flight crews with a "get-home package" in case of total electrical failure. Another potential benefit of such a system could be that it would allow for more options when de-powering an aircraft's electrical system in a smoke/fire event.

Following the SR 111 accident, Swissair decided to modify the standby flight instrument equipment in their aircraft. For their MD-11 aircraft, they chose to install a secondary flight display system (SFDS), which has a similar layout to the primary flight display in that aircraft. It includes attitude, altitude, airspeed and heading in one integrated display. In the event of a loss of primary aircraft electrical power to the unit, it has an auxiliary battery to supply power for a minimum of 45 minutes.

Regulatory authorities and others may wish to consider reviewing the requirements for standby instrumentation, including related issues such as standby communication and navigation capabilities. The above parties may also wish to review present regulations and practices to ensure that flight crews receive adequate training in the use of standby flight instruments, and that design standards be adequate to ensure that standby instruments are grouped adjacent to each other, and have a similar relative layout as the primary flight instruments.

Yours sincerely,

Daniel Verreault, P. Eng
Director, Air Investigations

c.c.

• Frank Hilldrup
  NTSB, Accredited Representative for SR 111 Accident
• Willi Schurter
  Swiss Air 111 Post Emergency Organisation
• Pamela Rosnik
  Boeing, Boeing Propulsion Technology
• Steven Wallace
  FAA, Director of Accident Investigation
• Vikki Anderson
  FAA, Air Safety Investigator
• Jean Overney
  Swiss AAIB, Chief Inspector
• ALPA
  Jim Stewart, Air Safety Coordinator - Canada
• FOCA
  Christine Gerber, Head of Section Continuing Airworthiness Section

Flight crew reading light (A000061-1)

Place du Centre
4^th Floor
200 Promenade du Portage
Hull, Quebec
K1A 1K8

622-A000061-1
825-A98H0003

29 December 2000

Mr. John Clark
A/Director, Office of Aviation Safety
National Transportation Safety Board
490 L'Enfant Plaza East S.W.
Washington, DC 20594

Re: Aviation Safety Information Letter A000061-1 (A98H0003)
Flight Crew Reading Light

Dear Mr. Clark;

On 02 March 2000, as part of its ongoing investigation into the circumstances surrounding the crash of Swissair 111 (SR-111) on 02 September 1998, the Transportation Safety Board of Canada (TSB) issued a Safety Advisory Letter to your office concerning a specific arcing condition of the MD-11 Flight Crew Reading Light (FCRL).^{Footnote 49} As you may be aware, Boeing released an associated Alert Service Bulletin (MD11 33A069 refers) and subsequently, the Federal Aviation Administration issued an Airworthiness Directive (AD) 2000-07-02 which remains in force to date.^{Footnote 50} The investigation has identified three additional failure modes of the FCRL, which are detailed in the attached Appendix.^{Footnote 51} The purpose of this letter is to update your agency on this additional information uncovered by the SR-111 investigation pertaining to these FCRL discrepancies.

While AD 2000-07-02 applies only to the MD-11, the same or similar FCRLs are installed in a variety of aircraft. The attached Appendix contains a listing of these other installations of similar FCRLs and related service information. The FCRL manufacturer has issued several Service Bulletins (SB) and Information Letters applicable to some of these variants. Implementation of the recommended changes referred to in these SB documents are not mandatory and their content addresses only the short circuit between the lamp contact spring and the FCRL carrier frame. It is interesting to note that the FCRL manufacturer has not issued any service information applicable to the DC-10, MD-11, or MD-80 aircraft. However, TSB is aware that design changes by the light manufacturer to address the other failure modes, are pending.

In an effort to facilitate whatever action(s) may be necessary to mitigate the risk highlighted by the original AD and subsequent investigative observations, the TSB has kept all concerned informed of these developments. Accordingly, this information is provided for whatever follow-up action you deem appropriate.

Yours sincerely,

Daniel Verreault, P. Eng.
Director, Air Investigations

c.c.

• Mr. John Overney - Accredited Representative for Switzerland
  Aircraft Accident Investigation Bureau
  Bahnholfplatz 10 B
  CH -3003 Berne, Switzerland
• Mr. J. McMenemy
  Transport Canada Minister's Observer
  Tower C, Place de Ville, 7^th Floor
  330 Sparks Street
  Ottawa, Ontario Canada
  K1A 0N8
• Mr. Bob Henley - Air Safety Investigator - FAA
  SR-111 FAA Liaison
  FAA Headquarters
  800 Independence Ave., S.W.
  Washington, DC 20591, U.S.A.
• Mr. Andre Auer - Director
  Federal Office for Civil Aviation
  Maulbeerstrasse 9, CH-3003 Berne, Switzerland
• Mr. Ronald J. Hinderberger
  Boeing Commercial Airplane Group
  Director Air Safety Investigation
  P.O. Box 3707
  MC 67-PR
  Seattle, Washington 98124-2207
• Mr. Willi Schurter
  SR 111 Post Emergency Organisation
  SR Technics
  CH-8058 Zurich-Airport
  Switzerland
• Mr. Reinhard Sikora
  Product Support Manager
  Hella Aerospace GmbH
  Bertramstrasse 8,
  59557 Lippstadt
  Germany
• Mr. P. Schlegel
  Chief Inspector of Accidents
  German Federal Bureau of Aircraft Accidents Investigation
  BFU
  Hermann-Blenk-Str. 16
  38108 Braunschweig
  Germany

Appendix to Aviation safety information letter A000061-1

Flight Crew Reading Light^{Footnote 52} (FCRL) Failure Modes:

1. Short circuit between the positive contact spring of the lamp and the FCRL carrier frame:
   In the case of a severely damaged or missing insulation bush (protective cover), it is possible that a short circuit may occur between the positive contact spring of the lamp and the grounded carrier frame of the FCRL.

   Image

   

   Image

   

2. Short to ground between universal joint suspension U-shaped bracket of the socket rivet assembly and the terminal connection under the orange insulating cap.

   The bracket of the universal joint suspension of the socket rivet assembly of this flight crew reading light has a bend radius of approximately 4.5 mm. There is, for design reasons, a distance of less than 1 mm between one of these brackets and the rear of the electrical terminal connection which is insulated by an orange rubber cap. During use, the bracket can pierce the insulating cap and cause a short circuit with the positive electrical terminal.

   Image

   

3. Short circuits between spare bulb holders and micro-switch assembly and

4. Short circuits between micro-switch assembly and universal joint suspension (U-shaped bracket) of the socket rivet assembly.

   Some of the metal holders of the spare bulbs exhibited signs of short circuits. These apparently occurred because the holder of the spare bulb has, during the insertion of the light assembly, caused a short circuit between the non-insulated connections of the micro-switch and the strap of the universal joint suspension of the socket rivet assembly.

   Image

   

   Image

   

Flight crew reading light installations:

Note: As of 1 June 2000, in excess of thirteen thousand (all part numbers) such fixtures had been delivered by Hella Aerospace.

Overhead aisle and emergency lights – MD–11 (A000062-1)

Place du Centre
4^th Floor
200 Promenade du Portage
Hull, Quebec K1A 1K8

622-A000062-1
825-A98H0003

29 December 2000

Mr. John Clark
A/Director, Office of Aviation Safety
National Transportation Safety Board
490 L'Enfant Plaza East S.W.
Washington, DC 20594

Re: Aviation Safety Information A000062-1 (A98H0003)
Overhead Aisle and Emergency Lights - MD-11

Dear Mr. Clark;

The investigation into the Swissair 111 (SR-111) accident has revealed an overheat condition involving the overhead aisle and emergency lights on MD-11 aircraft. Of ongoing interest to the investigators is the identification of any potential sources of heat that may provide a source of ignition. The purpose of this letter is to update your agency on the results of the investigation as it relates to these lights.

The interest in the MD-11 aisle and emergency light assemblies stems from the analysis of heat damaged ceiling panels from the SR-111 aircraft. This damage appeared to be associated with overheating of the light assembly. Examination of overhead aisle and emergency light assemblies installed on other in-service MD-11s revealed aisle light assemblies that exhibited heat deformation of light lenses and discolouration of associated ceiling panels. The attached Appendix summarizes the results of the investigation to date regarding these anomalies.

The Transportation Safety Board of Canada is not aware of any associated Service Bulletins, Information Letters or design changes regarding the overheating of the aisle light assemblies on MD-11 aircraft. Accordingly, this information is provided for whatever follow-up action you deem appropriate.

Yours sincerely,

Daniel Verreault, P. Eng.
Director, Air Investigations

c.c.

• Mr. John Overney - Accredited Representative for Switzerland
  Aircraft Accident Investigation Bureau
  Bahnholfplatz 10 B
  CH -3003 Berne, Switzerland
• Mr. J. McMenemyL
  Transport Canada Minister's Observer
  Tower C, Place de Ville, 7^th Floor
  330 Sparks Street
  Ottawa, Ontario Canada
  K1A 0N8
• Mr. Bob Henley - Air Safety Investigator - FAA
  SR-111 FAA Liaison
  FAA Headquarters
  800 Independence Ave., S.W.
  Washington, DC 20591, U.S.A.
• Mr. André Auer - Director
  Federal Office for Civil Aviation
  Maulbeerstrasse 9, CH-3003 Berne, Switzerland
• Mr. Ronald J. Hinderberger
  Boeing Commercial Airplane Group
  Director Air Safety Investigation
  P.O. Box 3707 MC
  67-PR
  Seattle, Washington 98124-2207
• Mr. Willi Schurter
  SR 111 Post Emergency Organisation
  SR Technics
  CH-8058 Zurich-Airport
  Switzerland

Appendix to Aviation safety information letter A000062-1

1. Overhead Aisle and Emergency Light Assembly^{Footnote 53} Observations

   Image

   

2. Non SR 111 Exhibits Illustrating Heat Damaged Lens and Heat Discolouration on Ceiling Panels

   Image

   

   Image

   

   Of three aircraft sampled the following results were recorded:

   Years in service	% of lens with heat deformation	% discolouration
   8 years	65	89
   4 years	3	90
   2 years	0	31

3. Electrical Current Rating: A measurement of the electrical current on a single aisle light was undertaken on a sample basis. With the incandescent bulb GE 623 specified by the manufacturer, a current of .52 A was measured. A stamp on the aisle light fixture indicates that it is designed for operation with a voltage of 28 V direct current and a current of 0.37 A. Therefore, the actual measured current was 143% of the rated current.
4. In-flight Temperatures: To determine the temperatures reached within the aisle and emergency light assemblies and in their immediate vicinity during normal flight operation, three aircraft were equipped with temperature measurement strips. In all three aircraft aisle light fixtures, peak temperatures of approximately 200 degrees C and average temperatures of between 143 and 160 degrees C were reached. Generally, the highest temperatures were measured in the first-class compartment whereas the temperatures in the business class tended to be lower. Temperatures between 110 and 138 degrees C were found on the outside of some of the aisle lights.

Overhead aisle and emergency lights – MD–11 (A000062-2)

Place du Centre
4^th Floor
200 Promenade du Portage
Hull, Quebec K1A 1K8

622-A000062-2
825-A98H0003

29 December 2000

Mr. R. Presnell
Manager, Customer Service
Luminator Aircraft Products
1200 E. Plano Parkway, Suite 300
Plano Texas 75074-0030

Re: Aviation Safety Information A000062-2 (A98H0003)
Overhead Aisle and Emergency Lights – MD-11

Dear Mr. Presnell;

The investigation into the Swissair 111 (SR-111) accident has revealed an overheat condition involving the overhead aisle and emergency lights on MD-11 aircraft. Of ongoing interest to the investigators is the identification of any potential sources of heat that may provide a source of ignition. The purpose of this letter is to update your company on the results of the investigation as it relates to these lights.

The circumstances of the SR-111 accident are now well known. On 2 September 1998, a Swissair McDonnell Douglas MD-11 (serial number 48448), HB-IWF, departed John F. Kennedy, New York at 2118 Atlantic daylight saving time, en route to Geneva, Switzerland. Approximately 53 minutes after take-off, as the aircraft was cruising at Flight Level 330, the crew noticed an unusual smell in the cockpit. Three and a half minutes later, the crew declared a "PAN PAN PAN" and advised the Air Traffic Services (ATS) controller of smoke in the cockpit and requested a diversion. About 11 minutes thereafter, the situation had deteriorated to the point that electrical systems were being significantly affected and the crew declared an "emergency" to ATS. About six and a half minutes later, at approximately 2231, the aircraft crashed into the Atlantic Ocean near Peggy's Cove, Nova Scotia, Canada. All 215 passengers and 14 crew members suffered fatal injuries. The Transportation Safety Board of Canada (TSB) investigation is continuing.

The TSB refers Safety Information Letters to the Canadian Department of Transport and to other stakeholders who may be interested in following up the safety information presented.

The interest in the MD-11 aisle and emergency light assemblies stems from the analysis of heat damaged ceiling panels from the SR-111 aircraft. This damage appeared to be associated with overheating of the light assembly. Examination of overhead aisle and emergency light assemblies installed on other in-service MD-11s revealed aisle light assemblies that exhibited heat deformation of light lenses and discolouration of associated ceiling panels. The attached Appendix summarizes the results of the investigation to date regarding these anomalies.

The TSB is not aware of any associated Service Bulletins, Information Letters or design changes regarding the overheating of the aisle light assemblies on MD-11 aircraft. Accordingly, this information is provided for whatever follow-up action you deem appropriate.

Yours sincerely,

Daniel Verreault, P. Eng.
Director, Air Investigations

Appendix to Aviation safety information letter A000062-2

1. Overhead Aisle and Emergency Light Assembly^{Footnote 53} Observations

   Image

   

2. Non SR 111 Exhibits Illustrating Heat Damaged Lens and Heat Discolouration on Ceiling Panels

   Image

   

   Image

   

   Of three aircraft sampled the following results were recorded:

   Years in service	% of lens with heat deformation	% discolouration
   8 years	65	89
   4 years	3	90
   2 years	0	31

3. Electrical Current Rating: A measurement of the electrical current on a single aisle light was undertaken on a sample basis. With the incandescent bulb GE 623 specified by the manufacturer, a current of .52 A was measured. A stamp on the aisle light fixture indicates that it is designed for operation with a voltage of 28 V direct current and a current of 0.37 A. Therefore, the actual measured current was 143% of the rated current.
4. In-flight Temperatures: To determine the temperatures reached within the aisle and emergency light assemblies and in their immediate vicinity during normal flight operation, three aircraft were equipped with temperature measurement strips. In all three aircraft aisle light fixtures, peak temperatures of approximately 200 degrees C and average temperatures of between 143 and 160 degrees C were reached. Generally, the highest temperatures were measured in the first-class compartment whereas the temperatures in the business class tended to be lower. Temperatures between 110 and 138 degrees C were found on the outside of some of the aisle lights.