Aviation Investigation Report A98H0003
In-flight fire leading to collision with water
Swissair Transport Limited
McDonnell Douglas MD-11 HB-IWF
Peggy's Cove, Nova Scotia 5 nm SW
The Transportation Safety Board of Canada (TSB) investigated this occurrence for the purpose of advancing transportation safety. It is not the function of the Board to assign fault or determine civil or criminal liability. This report is not created for use in the context of legal, disciplinary or other proceedings. See Ownership and use of content.
On 2 September 1998, Swissair Flight 111 departed New York, United States of America, at 2018 eastern daylight savings time on a scheduled flight to Geneva, Switzerland, with 215 passengers and 14 crew members on board. About 53 minutes after departure, while cruising at flight level 330, the flight crew smelled an abnormal odour in the cockpit. Their attention was then drawn to an unspecified area behind and above them and they began to investigate the source. Whatever they saw initially was shortly thereafter no longer perceived to be visible. They agreed that the origin of the anomaly was the air conditioning system. When they assessed that what they had seen or were now seeing was definitely smoke, they decided to divert. They initially began a turn toward Boston; however, when air traffic services mentioned Halifax, Nova Scotia, as an alternative airport, they changed the destination to the Halifax International Airport. While the flight crew was preparing for the landing in Halifax, they were unaware that a fire was spreading above the ceiling in the front area of the aircraft. About 13 minutes after the abnormal odour was detected, the aircraft's flight data recorder began to record a rapid succession of aircraft systems-related failures. The flight crew declared an emergency and indicated a need to land immediately. About one minute later, radio communications and secondary radar contact with the aircraft were lost, and the flight recorders stopped functioning. About five and one-half minutes later, the aircraft crashed into the ocean about five nautical miles southwest of Peggy's Cove, Nova Scotia, Canada. The aircraft was destroyed and there were no survivors.
Ce rapport est également disponible en français.
1.0 Factual information
The investigation of the Swissair Flight 111 (SR 111) occurrence was complex and involved detailed examination of many operational and technical issues. The information in Part 1 of the report is organized into the subject areas specified by the International Civil Aviation Organization investigation report format. While the investigation uncovered many facts with respect to the flight, the aircraft, maintenance, personnel, and so on, only factual information that is pertinent to understanding the SR 111 occurrence is provided in this part along with some preliminary evaluation (first-stage analysis) that serves as a basis for the Analysis, Conclusions, and Safety Action parts of the report.
1.1 History of the flight
This section summarizes, in chronological order according to Coordinated Universal Time (UTC),Footnote 1 the main events that occurred during the flight and that are directly related to the SR 111 occurrence ending with the aircraft's impact with the water near Peggy's Cove, Nova Scotia, Canada. Refer to Appendix A–Flight Profile: Selected Events for a graphical representation of the flight path of the aircraft.
At 0018 UTC (2018 eastern daylight savings time) on 2 September 1998, the McDonnell DouglasFootnote 2 (MD) MD-11, operating as SR 111, departed John F. Kennedy (JFK) International Airport in Jamaica, New York, United States of America (USA), on a flight to Geneva, Switzerland. Two pilots, 12 flight attendants, and 215 passengers were on board. The first officer was the pilot flying. At 0058, SR 111 contacted Moncton Air Traffic Services (ATS) Area Control Centre (ACC) and reported that they were at flight level (FL) 330.Footnote 3
At 0110:38, the pilots detected an unusual odour in the cockpit and began to investigate. They determined that some smoke was present in the cockpit, but not in the passenger cabin. They assessed that the odour and smoke were related to the air conditioning system. At 0114:15, SR 111 made a Pan PanFootnote 4 radio transmission to Moncton ACC. The aircraft was about 66 nautical miles (nm) southwest of Halifax International Airport, Nova Scotia. The pilots reported that there was smoke in the cockpit and requested an immediate return to a convenient place. The pilots named Boston, Massachusetts, which was about 300 nm behind them. The Moncton ACC controller immediately cleared SR 111 to turn right toward Boston and to descend to FL310. At 0115:06, the controller asked SR 111 whether they preferred to go to Halifax, Nova Scotia. The pilots expressed a preference for Halifax, which was considerably closer. They immediately received an ATS clearance to fly directly to Halifax, which was by then about 56 nm to the northeast. At this time, the pilots donned their oxygen masks.
At 0116:34, the controller cleared SR 111 to descend to 10 000 feet above sea level,Footnote 5 and asked for the number of passengers and amount of fuel on board. The pilots asked the controller to stand by for that information. At 0118:17, the controller instructed SR 111 to contact Moncton ACC on radio frequency (RF) 119.2 megahertz (MHz). SR 111 immediately made contact with Moncton ACC on 119.2 MHz and stated that the aircraft was descending out of FL254 on a heading of 050 degreesFootnote 6 on course to Halifax. The controller cleared SR 111 to 3 000 feet. The pilots requested an intermediate altitude of 8 000 feet until the cabin was ready for landing.
At 0119:28, the controller instructed SR 111 to turn left to a heading of 030 for a landing on Runway 06 at the Halifax International Airport, and advised that the aircraft was 30 nm from the runway threshold. The aircraft was descending through approximately FL210 and the pilots indicated that they needed more than 30 nm. The controller instructed SR 111 to turn to a heading of 360 to provide more track distance for the aircraft to lose altitude. At 0120:48, the flight crew discussed internally the dumping of fuel based on the aircraft's gross weight, and on their perception of the cues regarding the aircraft condition, and agreed to dump fuel. At 0121:20, the controller made a second request for the number of persons and amount of fuel on board. SR 111 did not relay the number of persons on board, but indicated that the aircraft had 230 tonnes (t) of fuel on board (this was actually the current weight of the aircraft, not the amount of fuel) and specified the need to dump some fuel prior to landing.
At 0121:38, the controller asked the pilots whether they would be able to turn to the south to dump fuel, or whether they wished to stay closer to the airport. Upon receiving confirmation from the pilots that a turn to the south was acceptable, the controller instructed SR 111 to turn left to a heading of 200, and asked the pilots to advise when they were ready to dump fuel. The controller indicated that SR 111 had 10 nm to go before it would be off the coast, and that the aircraft was still within 25 nm of the Halifax airport. The pilots indicated that they were turning and that they were descending to 10 000 feet for the fuel dumping.
At 0122:33, the controller heard, but did not understand, a radio transmission from SR 111 that was spoken in Swiss-German, and asked SR 111 to repeat the transmission. The pilots indicated that the radio transmission was meant to be an internal communication only; the transmission had referred to the Air Conditioning Smoke checklist (see Appendix B–Swissair Air Conditioning Smoke Checklist).
At 0123:30, the controller instructed SR 111 to turn the aircraft farther left to a heading of 180, and informed the pilots that they would be off the coast in about 15 nm.Footnote 7 The pilots acknowledged the new heading and advised that the aircraft was level at 10 000 feet.
At 0123:53, the controller notified SR 111 that the aircraft would be remaining within about 35 to 40 nm of the airport in case they needed to get to the airport in a hurry. The pilots indicated that this was fine and asked to be notified when they could start dumping fuel. Twenty seconds later, the pilots notified the controller that they had to fly the aircraft manually and asked for a clearance to fly between 11 000 and 9 000 feet. The controller notified SR 111 that they were cleared to fly at any altitude between 5 000 and 12 000 feet.
At 0124:42, both pilots almost simultaneously declared an emergency on frequency 119.2 MHz; the controller acknowledged this transmission. At 0124:53, SR 111 indicated that they were starting to dump fuel and that they had to land immediately. The controller indicated that he would get back to them in just a couple of miles. SR 111 acknowledged this transmission.
At 0125:02, SR 111 again declared an emergency, which the controller acknowledged. At 0125:16, the controller cleared SR 111 to dump fuel; there was no response from the pilots. At 0125:40, the controller repeated the clearance. There was no further communication between SR 111 and the controller.
At approximately 0130, observers in the area of St. Margaret's Bay, Nova Scotia, saw a large aircraft fly overhead at low altitude and heard the sound of its engines. At about 0131, several observers heard a sound described as a loud clap. Seismographic recorders in Halifax, Nova Scotia, and in Moncton, New Brunswick, recorded a seismic event at 0131:18, which coincides with the time the aircraft struck the water. The aircraft was destroyed by impact forces. There were no survivors.
The accident occurred during the hours of darkness. The centre of the debris field, located on the ocean floor at a depth of about 55 metres (m) (180 feet), was at the approximate coordinates of latitude 44°24′33″ North and longitude 063° 58′25″ West.
Table 1 conveys the general time frame of the events between the first detection of an unusual odour in the cockpit and the time of impact with the water.
|UTC time||Elapsed time (minutes)||Event|
|0110:38||00:00||Unusual smell detected in the cockpit|
|0113:14||02:36||Smoke assessed as visible at some location in the cockpit; no smell reported in cabin|
|0114:15||03:37||SR 111 radio call: "Pan Pan Pan"; diversion requested naming Boston (It is unknown whether visible smoke was still present in the cockpit)|
|0115:36||04:58||Decision made to divert to Halifax, Nova Scotia|
|0120:54||10:16||Decision made to dump fuel|
|0123:45||13:07||CABIN BUS switch selected to OFF|
|0124:09||13:31||Autopilot 2 disengages, and the flight data recorder (FDR) begins to record aircraft system failures|
|0125:02||14:24||ATS receives last communication from SR 111|
|0125:41||15:03||Recorders stop recording|
|0131:18||20:40||Impact with water|
For a more detailed description of the timeline, sequence of events, and flight profile, refer to sections 22.214.171.124 and 126.96.36.199, and to Appendix A–Flight Profile: Selected Events and Appendix D–Timeline.
1.2 Injuries to persons
Post-accident medical and pathological information that describes the nature of the injuries is presented in Section 1.13, Medical Information.
1.3 Damage to aircraft
The aircraft was destroyed by the forces of impact with the water. Most aircraft debris sank to the ocean floor. Initially, some aircraft debris was found floating in the area where the aircraft struck the water, while other debris had drifted slightly west of the crash location. Over the next several weeks, debris from the aircraft was also found floating in shoreline areas and washed up on various beaches.
1.4 Other damage
Jet fuel was present on the surface of the water near the impact site for a few hours before evaporating. There was no apparent damage to the environment from the aircraft debris. The area surrounding the impact site was closed to marine traffic, including local fishery and tour boat operations, during salvage operations that lasted for approximately 13 months.
1.5 Personnel information
The SR 111 flight crew consisted of a captain and a first officer. The cabin crew consisted of a maître de cabine (M/C) and 11 flight attendants.
A flight operations officer provided standard flight preparation support to the flight crew before their departure from JFK airport.
Two air traffic controllers at Moncton ACC had radio contact with the aircraft: a high-level controller and a terminal controller.
1.5.2 Flight crew
|Pilot licence||Swiss Airline Transport Pilot Licence||Swiss Airline Transport Pilot Licence|
|Medical expiration date||1 November 1998||1 July 1999|
|Total flying hours||10 800||4 800|
|Hours on type||900||230|
|Hours last 90 days||180||125|
|Hours on type last 90 days||180||125|
|Hours on duty prior to occurrence||3||3|
|Hours off duty prior to work period||27||27|
The pilot-in-command (captain) of SR 111 was described as being in good health, fit, and not taking any prescribed medication. He was described as someone who created a friendly and professional atmosphere in the cockpit and was known to work with exactness and precision. It was reported that there was no tension in the cockpit when flying with this captain.
The captain began flying for recreation in 1966 at the age of 18. In 1967, he joined the Swiss Air Force and became a fighter pilot. He began his career with Swissair in July 1971 as a first officer on the McDonnell Douglas DC-9 and later transitioned as a first officer to the McDonnell Douglas DC-8.
He was upgraded to captain status in April 1983 on the DC-9 and flew the McDonnell Douglas MD-80 as pilot-in-command from 1986 to 1994. In August 1994, he completed transition training to fly the Airbus A320, and became an A320 captain and instructor pilot. In June 1997, he completed transition training on the MD-11. He was qualified and certified in accordance with Swiss regulations. He held a valid Swiss airline transport pilot licence (ATPL). His instrument flight rules (IFR) qualifications for Category I and Category III approaches were valid until 21 October 1998. His flying time with Swissair totalled 9 294 hours. His last flying proficiency check was conducted on 23 February 1998.
The captain had never been exposed to a regulatory or administrative inquiry. There is no record to indicate that he had experienced an actual in-flight emergency at any time during his flying career.
As well as being a line pilot, the captain was an instructor pilot on the MD-11. He instructed in the full flight simulator on all exercises, including the pilot qualification training lesson where the Smoke/Fumes of Unknown Origin checklist is practised (see Appendix C–Swissair Smoke/Fumes of Unknown Origin Checklist). The captain was known to give detailed briefings to his students before, during, and after their simulator sessions. To increase his aircraft knowledge, the captain would question technical specialists in the maintenance department about the aircraft and its systems. During "smoke in the cockpit" training sessions, the captain required the students to explain all the steps and consequences of using the "electrical and air smoke isolation" (SMOKE ELEC/AIR) selectorFootnote 8 prior to conducting the exercise. During these sessions, it was the captain's practice to ensure that the pilot reading the checklist would inform the pilot flying what services he or she was about to lose prior to turning the selector.
During wreckage recovery, a prescription for eyeglasses for the captain was found among the recovered personal effects. The prescription correction was for distance vision. No glasses identified as belonging to the captain were recovered. The available information indicates that the captain did not normally wear eyeglasses except sometimes for distance vision correction. The captain met the visual standard without glasses on his last aviation medical examination. The presence or absence of the captain's glasses would not have affected his ability to deal with the situations that he encountered in this occurrence.
Based on a review of the captain's medical records, there was no indication of any pre-existing medical condition or physiological factors that would have adversely affected his performance during the flight. His last medical examination took place on 29 April 1998; no medical restrictions applied to his pilot licence.
188.8.131.52 First officer
The first officer was described as being in good health and as not taking any prescription medication. He was considered to be experienced, well qualified, focused, and open-minded in performing the duties of a first officer. His cockpit discipline was described as ideal. He was described as a partner in the cockpit, with a quiet and calm demeanour; he was assertive when appropriate.
The first officer started flying in 1979, became a Swiss Air Force pilot in 1982 and completed his full-time military service in 1990. He joined Swissair in 1991 as a first officer on the MD-80 while continuing to fly in the air force part-time as a fighter pilot. In December 1995, he transitioned to the Airbus A320 as a first officer. In May 1998, he successfully completed his training as a first officer on the MD-11. He held a valid Swiss ATPL, which was issued in August 1996.
The first officer had never been exposed to a regulatory or administrative inquiry. There is no record to indicate that he had experienced an actual in-flight emergency at any time during his flying career. He was qualified and had been certified in accordance with Swiss regulations. His last proficiency check was on 16 April 1998.
The first officer had been an instructor on the MD-80 and A320, and at the time of the occurrence, was an instructor on the MD-11 as a simulator and transition instructor. He had accumulated 230 hours of flying time on the MD-11 and was described as having good knowledge of the aircraft systems. His flying time with Swissair totalled 2 739 hours.
Based on a review of the first officer's medical records, there was no indication of any pre-existing medical condition or physiological factors that would have adversely affected his performance during the flight. His last medical examination took place on 15 June 1998; no medical restrictions applied to his licence.
1.5.3 Cabin crew
The M/C and the other 11 flight attendants were fully qualified and trained in accordance with the existing Joint Aviation Authorities (JAA) regulatory requirements.
1.5.4 Seventy-two-hour history
A review of the flight and duty times for the flight and cabin crew revealed that they were all in accordance with the limitations prescribed by Swissair policies and JAA regulations.
The captain was off duty from Saturday, 29 August, up to and including Monday, 31 August, and was reported to have been well rested prior to departing for the outbound flight from Zurich to Geneva to New York on Tuesday, 1 September. Normal crew rest time was allocated to the crew while in New York.
The first officer was off duty from 30 to 31 August, and was reported to have been well rested prior to reporting for duty on Tuesday, 1 September.
On 1 September the two members of the flight crew, and 7 of the 12 cabin crew deadheadedFootnote 9 from Zurich to Geneva on Swissair Flight 920 (SR 920). The aircraft departed the gate in Zurich at 0643, arriving at the gate in Geneva at 0723. The remaining five flight attendants joined the rest of the aircraft crew in Geneva. The flight and cabin crews assumed flying duties on Swissair Flight 110 (SR 110), Geneva to New York. SR 110 departed the gate in Geneva at 1018, arriving in New York at 1835 on 1 September. The aircraft used for SR 110 was not the accident aircraft.
In accordance with Swissair procedures, on 2 September 1998, the day of the homebound flight to Geneva, the pilots received at their hotel a pre-flight information package from the Swissair Flight Operations Centre (FOC) at JFK airport. Included in this package was flight routing, weather, and aircraft weight information (i.e., weight based on preliminary information).
The aircraft crew checked out of their hotel in New York at 1750 local time (2150 UTC) on 2 September 1998 and arrived at the airport one hour before the scheduled departure time for SR 111 of 1950 local time (2350 UTC). On arrival at the airport, all aircraft crew members passed through terminal security and checked their bags at the Swissair check-in area. The cabin crew proceeded directly to the aircraft. The pilots reported to the FOC where they completed their flight planning and then proceeded to the aircraft. The flight departed the gate in New York at 1953 local time (2353 UTC).
The aircraft crew's circadianFootnote 10 time was likely close to Swiss time (UTC plus two hours) as they would not have had enough time in New York to significantly adjust their circadian rhythm to local (New York) time. Their circadian time was not considered to be a factor in the occurrence.
1.5.5 Air traffic controllers
All of the Nav Canada air traffic controllers involved with the SR 111 flight were current and qualified for their positions in accordance with existing Canadian regulations. The controllers were considered to be suitably experienced (see Table 4) and were being supervised as required. At the time of the occurrence, the workload of the controllers in the Moncton ACC was assessed as light. The initial SR 111 radio communications with Moncton ACC were handled by the high-level controller who, at 0118:11, handed off the ATS function to the terminal radar controller for the approach and landing at Halifax.
|High-level controller||Terminal radar controller|
|Licence||Air traffic control||Air traffic control|
|Experience as a controller||9 years||26 years|
|Experience as an IFR controller||9 years||26 years|
|Experience in present unit||3.5 years||26 years|
|Hours on duty before accident||5||8|
|Hours off duty before work period||72||16.25|
1.6 Aircraft information
This section provides the following information:
- A general description of the occurrence aircraft; and
- A description of the operation, airworthiness, and maintenance of specific aircraft systems (environmental, automatic flight, warnings, communications, electrical, fire protection, etc.) and equipment deemed relevant to the occurrence investigation.
The systems and equipment described herein are specific to Swissair's MD-11 configuration and may not be accurate for other MD-11 configurations.
|Manufacturer||McDonnell Douglas Corporation|
|Type and model||MD-11|
|Year of manufacture||1991|
|Serial number (SN)||48448|
|Certificate of airworthiness||Issued 28 July 1991|
|Total airframe time (hours)||36 041|
|Engine type (number of)||Pratt & Whitney 4462 (3)|
|Maximum take-off weight||285 990 kilograms (kg)|
|Recommended fuel types||Jet A, Jet A-1, JP-5, JP-8, Jet B|
|Fuel type used||Jet A|
184.108.40.206 MD-11 design and configuration
The McDonnell Douglas MD-11 design project began in 1986. The MD-11 design is structurally based on the McDonnell Douglas DC-10 design (see Figure 1 and Figure 2). The MD-11 was designed for more economical and efficient operation than the DC-10, by incorporating modern, automated systems. The redesign automated most of the functions that were performed by the flight engineer in the DC-10, thereby allowing for a two-crew cockpit. The first MD-11 flight was on 10 January 1990 and delivery of the aircraft to the first customer was on 7 December 1990. The occurrence aircraft was manufactured in 1991 and was put directly into service by Swissair.
As the MD-11 was manufactured and certified in the United States (US) in accordance with applicable Federal Aviation Regulations (FAR), the regulatory focus of this report is directed toward the Federal Aviation Administration (FAA). Many civil aviation authorities (CAA) have drafted or harmonized their respective certification and continuing airworthiness regulations based on the FAA model; therefore, the issues in this report may also apply to other regulatory authorities.
The occurrence aircraft was configured with 241 passenger seats: 12 first class, 49 business class, and 180 economy class. The first- and business-class seats were equipped with an in-flight entertainment system,Footnote 11 certified and installed in accordance with a US FAA Supplemental Type Certificate (STC).
220.127.116.11 Weight and balance
Weight and balance calculations completed after the occurrence determined that the actual take-off weight for SR 111 was approximately 241 100 kg. The centre of gravity (C of G) was calculated to be 20 per cent mean aerodynamic chord (MAC). Other than very small differences, the post-occurrence calculations confirmed that the weight and balance calculations used for dispatch were accurate. The aircraft's weight was within limits, and throughout the flight the C of G was within the normal range (15 to 32 per cent MAC). The maximum allowable landing weight for the aircraft was 199 580 kg; the maximum overweight landing weight, allowable under certain conditions, was 218 400 kg. In an emergency, from an aircraft structural limit perspective, the aircraft can land at any weight; however, operational aspects, such as required stopping distance versus available runway distance, must be considered.
18.104.22.168 Aircraft coordinate system
The MD-11 fuselage comprises six major sections and two minor sections (see Figure 2). The major sections extend from Section B, the nose/cockpit area of the aircraft, to Section G, the aft fuselage section. The two minor sections, sections 6 and 5, were inserted fore and aft of Section E to extend the length of the original DC-10 fuselage. Each fuselage section consists of the external skin, internal circumferential frames, and longitudinal stiffening members (longerons and intercostals). Figure 2 also shows the locations of numerous manufacturing stations (STA), fuselage sections, the forward doors, lavatories (LAV), and galleys.
An X, Y, Z Cartesian coordinate system is used to identify any point within the aircraft.
- The X-axis extends laterally across the width of the aircraft. Lateral coordinates are measured in inches left or right of the fuselage longitudinal centre line. From the centre line toward the left wing, locations are positive coordinates (e.g., X= 80); locations toward the right wing are negative coordinates (e.g., X= −80).
- The Y-axis extends longitudinally from the nose to tail, is expressed in STAs, and is measured in inches aft of a designated point in front of the aircraft. For the MD-11, the tip of the nose of the aircraft is located at STA 239 and the cockpit door is located at STA 383.
- The Z-axis extends vertically through the aircraft. Vertical coordinates are measured in inches above or below the waterline (Z= 0), which, in the MD-11, is located 18 inches above the cabin floor. The cabin floor is therefore located at Z= −18.
22.214.171.124 Cockpit attic and forward cabin drop-ceiling areas–Description
The following section describes the cockpit attic and forward cabin drop-ceiling areas (see Figure 2, Figure 3, Figure 4, Figure 5, Figure 6, and Figure 7); the fire damageFootnote 12 and fire propagation in these areas is discussed in other sections of this report.
The space above the cockpit ceiling liner and the passenger cabin ceiling is referred to as the "attic" (see Figure 2). In Swissair MD-11 aircraft, the attic was divided at the cockpit rear wall. On the right side, the aluminum cockpit wall extended vertically to provide the division. On the left side, a single vertical smoke barrier was installed. (See Figure 3.)
The smoke barrier assembly above the left half of the cockpit rear wall consisted of a curtain made of nylon elastomer-coated cloth that was suspended from a curved aluminum alloy curtain rod. Hook-and-loop fastenerFootnote 13 was used around most of the outer periphery of the cloth to attach it to the curtain rod, as well as to attach it to the adjacent aircraft structure along the bottom and right side. Thermal acoustic insulation blanket (insulation blanket) splicing tape was installed along the entire top edge of the smoke barrier to close gaps between the rod and the adjacent insulation blankets. The smoke barrier was designed with the following openings: three near the top of the curtain to permit the engine fire shut-off cables to pass through and two near the centre of the curtain to accommodate the installation of the cockpit air ducts.
Regulations require the installation of a smoke barrier between the cockpit and the rear of the aircraft in cargo and combination cargo/passenger configurations. However, there is no regulatory requirement to install smoke barriers in passenger aircraft, nor is there a requirement for the smoke barrier to meet a fire rating or fire blocking standard specific to a passenger aircraft application. Regardless, the barrier was certified to meet general aircraft material requirements and was installed in the aircraft during manufacture.
Examination of other Swissair MD-11 aircraft in the Swissair fleet disclosed that openings existed in the smoke barriers, and in areas adjacent to the barrier. Some of these openings were located at conduit and wire run locations that pass through or above the cockpit rear wall. The top edge of the rear, right cockpit wall near STA 383 has a cut-out in it to permit the passage of wire bundles and conduits. (See Figure 4 and Figure 5.)
Three 102-centimetre (cm) (40-inch) long conduitsFootnote 14 and five wire bundles pass over the cockpit rear wall at this point, and continue aft over the top of Galley 2 between STA 383 and STA 420. (See Figure 3, Figure 4, Figure 5, and Figure 7.) The ends of the conduits were not required to be sealed and were found unsealed in other MD-11 aircraft that were examined. These conduits and wire bundles are attached by straps to a series of wire support brackets located at STA 383, 392, 401, 410, and 420. The wire bracket positioned at STA 383 is at a slight angle relative to the cockpit wall, which is directly below it. The top edge of this bracket, and attached wire bundles, are in contact with the metallized polyethylene terephthalate (MPET)-covered insulation blanket. Each of the conduits protrude forward of the cockpit wall by varying amounts because of the angle of the wall to the bracket.
Typically, the forward protrusion of the outboard conduit is the shortest of the three and the forward protrusion of the inboard conduit is the longest. These lengths, as measured from the bracket, vary from approximately 2.5 to 8 cm (1 to 3 inches) for the outboard and middle conduits. The inboard conduit was not used for any of the in-flight entertainment network (IFEN) installations. The cut-out extends downward approximately 8 cm (3 inches) from the top of the wall and is approximately 48 cm (19 inches) wide. A piece of closed-cell polyethylene foam containing fire retardant additives (i.e., part number (PN) NBN6718-83; Douglas Material Specification (DMS) 1954, Class 1, Grade 4101) is installed at this location to act as filler material for the cut-out.
Between STA 366 and STA 383 there are a number of wire support brackets installed in the fore-aft direction. These brackets are used to support wire bundles routed from behind the observer's station down into the avionics compartment; this area is commonly referred to as the "ladder area."Footnote 15 The aft end of the top bracket in the "ladder" is located near the outboard end of the cut-out in the cockpit wall (see Figure 3 and Figure 5). The brackets, and many of the wire bundles, are pressed up against, and closely follow, the curved contour of the fuselage over-frame MPET-covered insulation blankets.
Just aft of the right side of the cockpit rear wall, above Galley 2, a sound-suppression muff assembly (muff assembly) was installed around a splice junction of the conditioned air riser duct assembly (see Figure 6). The muff assembly uses an MPET-covered insulation blanket secured at both ends by hook-and-loop fasteners.
A second type of closed-cell polyethylene foam (PN ABE7049-41) was used around the windshield defog terminal blocks on the left side of the cockpit. A sample of the second type of foam (PN ABE7049-41) was removed from a Swissair MD-11 aircraft and tested. When the sample specimen was exposed to a small flame, the specimen ignited easily and burned.
Both of these foam materials were specified to DMS 1954, Class 1, Grade 4101, which states that the foam should possess fire-retardant additives and be certified to pass a 12-second vertical burn test as required in FAR 25.853, Appendix F. Literature indicates that both foams met FAR 25.853, Appendix F for commercial aircraft interior compartment components.
The manufacturer's material safety data sheet product code 37076 for the Dow Chemical Ethafoam® 4101, PN NBN6718-83, dated 23 August 1993, and current product information indicate that this polyethylene foam is combustibleFootnote 16 and should not be exposed to flame or other ignition sources.
No foam was identified from the cockpit area of the occurrence aircraft.
In the Swissair MD-11s, the forward end of the muff assembly comes into close proximity to the lower right edge of the smoke barrier, and to the vent duct assembly for Galley 2. The galley vent duct, which is designed to exhaust odours and hot air from the galley when in operation, was not connected to the top of Galley 2, as Galley 2 was not electrically powered and not in service. A silicone elastomeric end cap was placed over the vent duct to close it off. The cap was located between the aft side of the cockpit rear wall and the forward side of one of the three riser ducts (see Figure 4 and Figure 6).
Five wire bundles and three conduits run aft from the cockpit and over the top of the riser duct assembly. The majority of the wire bundles descend from the wire support bracket at STA 420 to pass under the R1 door, flapper door ramp deflector. This drop in the wire bundles is generally referred to as the "waterfall" area (see Figure 7). Two of the wire runs, namely FDC and FBC, are clamped together and attached to a ceiling support tube located at approximately STA 427. This clamping arrangement is referred to in this report as a "marriage clamp." The ramp deflector is used to minimize the possibility of the forward right passenger door flapper panel from damaging adjacent wire assemblies if the flapper panel torsion spring should fail. The door flapper panel moves with the passenger cabin door when the door is raised or lowered.
1.6.2 Environmental (Air) system
Outside air is pressurized by each of the three engines. This pressurized air is bled off the engines to provide a source of heated and pressurized air to operate the various environmental subsystems, including the air conditioning packs and pressurization systems (see Figure 8). The three air packs are contained in compartments located to the left and right of the nosewheel well area. Each air pack supplies conditioned air to a common manifold located below the cabin floor.
Air from the common manifold travels through a self-contained distribution system of lines and ducts, and enters the cockpit and passenger areas via outlets located throughout the aircraft. Anomalies, such as leaking engine oil seals, can sometimes introduce contaminants, such as engine lubricating oil, into the bleed air system. Pyrolysis of these contaminants can give rise to potential smoke and odours in the conditioned air supply. Incidents where smoke or odours have entered the cockpit and passenger cabin through the bleed air system of commercial aircraft as a result of contamination have been reported frequently.
Air from the cockpit, passenger cabin, and the remainder of the pressure vesselFootnote 17 is vented overboard through an outflow valve located on the left side of the aircraft slightly ahead of the wing.
For normal operations, the air conditioning system is automatically controlled by the environmental system controller (ESC). The air system can also be operated manually by the pilots using the air systems control panel (ASCP) located in the overhead switch panel in the cockpit (see Figure 8 and Figure 11).
Insulation blankets are used extensively throughout the aircraft to wrap the air distribution ducts to provide a thermal barrier. They are also installed between all fuselage frames; in some areas a second layer is installed over the frames. These insulation blankets provide a barrier against hot or cold exterior temperatures, and noise that could otherwise enter the passenger cabin and cockpit.
126.96.36.199 Air distribution system–Cockpit and cabin
In the Swissair MD-11 configuration, conditioned air from the common air manifold located below the cabin floor is distributed to five zones through lines and ducts; Zone 1 is the cockpit and zones 2 to 5 are areas within the cabin (see Figure 8).
The ducts and lines continuously supply the cockpit with 500 cubic feet per minute (cfm) of conditioned fresh air regardless of the flow setting selected for the passenger cabin. The air enters the cockpit from numerous vents, including three outlets from the overhead diffuser assembly, window diffusers, overhead individual air outlets, and foot-warmer outlets (see Figure 8, Figure 9, and Figure 10). All of these cockpit vents can be fully closed with the exception of the centre overhead diffuser, which has a minimum fixed opening. Manually operated controls are used to regulate the airflow from the overhead diffuser assembly and the window diffusers. Three rotary controls for the overhead diffuser assembly are located at the rear of the overhead ceiling liner. The right window diffuser slide control is located in the right ceiling liner, above the first officer's position aft of the windscreen. The left window diffuser slide control is located in the left ceiling liner behind the captain's position, just inboard of the left aft window.
Air in the cockpit generally flows from the diffusers down and around the flight crew seats, then forward past the rudder pedals and into the avionics compartment below the cockpit floor. (See Figure 10.)
Although the incoming conditioned air from all three air packs is mixed in the common manifold before the air enters the distribution ducts, the proximity within the manifold of the Air Pack 1 inlet and the cockpit and Zone 5 outlets is such that an odour from Air Pack 1 could reach the cockpit and Zone 5 before reaching the other zones.
Conditioned air for the passenger cabin areas is ducted to overhead plenums and directed down toward the floor. This air circulates around the passenger seats, then migrates to airflow vent boxes located along both sides of the passenger cabin floor. Air from the airflow vent boxes is directed through under-floor tunnels to the outflow valve. The outflow valve consists of two small doors located on the lower left side of the fuselage at STA 920. These doors are regulated open or closed to control cabin pressurization.
188.8.131.52 Passenger cabin air system
The passenger cabin air system in the MD-11 is equipped with an economy (ECON) modeFootnote 18 that mixes fresh conditioned air with recirculated cabin air and distributes it to the cabin zones (see Figure 8). The cabin air system consists of four recirculation fans and one individual air fan, called a "gasper" fan, which are all located above the ceiling in the forward and centre cabin area. In the ECON mode, the recirculation fans draw air from above the ceiling. This air is then mixed with the fresh conditioned air supply before being distributed back into the passenger cabin. Normally, the four recirculation fans operate continuously, but can be manually turned off by selection in the cockpit of either the ECON switch, the CABIN BUS switch, or the SMOKE ELEC/AIR selector. The ESC will automatically shut off the recirculation fans when there is a demand for a lower cabin temperature or when a generator overload occurs.
The gasper fan provides a constant supply of air to the passengers' individual air outlets, and operates independently of both the ECON mode and the temperature selection. The gasper fan is turned off by selecting the CABIN BUS switch to the OFF position, or by selecting the SMOKE ELEC/AIR selector to the 3/1 OFF position.
There is a thumbwheel PAX LOAD selector on the ASCP to allow the pilots to input the number of passengers on board to the nearest 10. The ESC schedules the flow of conditioned air to the cabin based on this input. In the ECON ON configuration, the MD-11 air conditioning schedule is determined by combining 10 cfm of fresh air for each of the passengers, with 700 cfm from each of the four recirculation fans. Swissair chose to use a default setting of 260 passengers with all four recirculation fans operating. This default setting results in a mixed airflow of 5 400 cfm of fresh and recirculated air to the passenger cabin. In the ECON OFF configuration, the air conditioning schedule is set to 5 500 cfm to the passenger cabin.
Each of the recirculation fans and the gasper fan incorporates a high-efficiency particulate air filter (Donaldson Company PN AB0467286) constructed of pleated microglass fibre media with aluminum separators to maintain pleat spacing. The filter was life tested to the American Society of Heating, Refrigeration and Air Conditioning EngineersFootnote 19 Standard 52.1, meets military standard (MIL-STD)-282,Footnote 20 and is rated by its ability to capture and retain oil particles that are 0.3 micrometres (microns) in size.Footnote 21
The filter is rated to remove 95 per cent of all 0.3 micron-size particles, and various capture mechanisms within the filter result in a higher efficiency in removing particles both smaller than, and larger than, 0.3 microns. For example, most tobacco smoke particulates, which are typically 0.01 to 1.0 micron in size, would be removed, as would larger particles, such as those produced when thermal acoustic insulation cover material burns.
During the initial stages of the fire on board the occurrence aircraft, the filter efficiency would have increased over time as particulates became entrapped in the filter. It would be expected that the filters would remove most of the smokeFootnote 22 particulates from the recirculated air during the initial stages of the in-flight fire. Although this filter is not classified as an odour-removing type, some odours associated with particulate contaminants would also be expected to be removed or diminished, while gaseous odours would be expected to pass through the filter.
184.108.40.206 Air conditioning–Smoke isolation system
If smoke or fumes are identified as coming from the air conditioning system, the flight crew are trained to use the Air Conditioning Smoke Checklist (see Appendix B). The checklist directs the flight crew to isolate the smoke source by selecting ECON OFF. If this does not isolate the smoke source, the next action on the checklist, after pushing the AIR SYSTEM push button to MANUAL, is to re-select ECON ON and select one of the air conditioning packs off. If this does not isolate the smoke source, the pack is selected back on and another pack is selected off. Each of the three air conditioning packs can be individually shut down to determine which of the three is the origin of the smoke. Air conditioning packs are shut down by selecting the air system to MANUAL, and then turning the appropriate air conditioning pack off on the ASCP; in turn, this closes the respective pack flow control valve. If the smoke decreases, the bleed air source for the air conditioning pack can be turned off, and the respective isolation valve can be opened.
1.6.3 Ditching mode
In the event that an emergency water landing is required, the aircraft can be configured for ditching by activating a DITCHING push button located to the right of the cabin pressure control panel on the overhead switch panel. When pushed, the switch provides a signal to the ESC, which then controls the various systems to prepare the aircraft for ditching. The existing cabin altitude is maintained during descent until the aircraft pressurization reaches zero differential, or until the aircraft descends through 2 500 feet, at which point the air packs are shut down. To maintain a watertight fuselage, the air pack ram air doors, the outflow valve, and the avionics and aft tunnel venturi valves are closed.
Examination of the SR 111 wreckage revealed that one air pack had been shut down. None of the other components expected to be closed if the DITCHING mode was selected were found in the ditching configuration. This would indicate that the DITCHING push button was not pushed; however, it could not be determined what effects the fire might have had on the serviceability of the associated systems.
1.6.4 Auto flight system
The MD-11 is equipped with an auto flight system (AFS) that is an integral part of the automatic and manual control system of the aircraft. The AFS consists of two, dual-channel flight control computers (FCC) with two integrated autopilots, flight directors (FD), autothrottle, and engine trim controls. Manual override of the automatic flight controls and autothrottle is always available.
The AFS hardware consists of the two FCCs, a dual-channel flight control panel (FCP), an automatic flight system control panel, a duplex flap limit servo, a duplex elevator load feel servo, a duplex autothrottle servo, and two control wheel force transducers. The AFS provides fail-operational Category IIIB auto-land through ground roll-out, and integrated windshear detection/warning with autopilot, FD, and autothrottle guidance escape capability.
The FCP, located on the glareshield control panel, provides the interface between the flight crew, the AFS, and the flight management system (FMS). The AFS incorporates airspeed and flight path protective features that automatically override the selected airspeed or flight path commands or both to prevent over or under speed.
Each dual-channel FCC has two similar functioning lanes. Each lane has two central processing units, which continually monitor the health of the other lane. A detected fault in the operating lane will automatically disconnect that function. For example, an autopilot fault will result in the autopilot disconnecting. Should this happen, the autopilot disengage warning system would activate a flashing red "AP OFF" alert on the flight mode annunciator and a cyclic (warbler) aural warning tone. The warbler can be reset, after at least one cycle of the tone has been completed, by pushing either of the autopilot disconnect switches installed on the outboard horn of both control wheels or by re-engaging the autopilot.
Each FCC receives inputs from the following sources:
- Inertial reference units 1, 2, 3 (IRU-1, -2, -3);
- Air data computers 1, 2 (ADC-1, -2);
- Radio altimeter 1, 2 (RA-1, -2);
- Both instrument landing systems (ILS), Flight Management Computer 1, 2 (FMC-1, -2);
- All three full-authority digital electronic control (FADEC) engine control units, flight control sensor data, selected references from the FCP; and
- Other information, such as weight on wheels, and gear and flap position.
The FCCs send digital signals to the electronic instrument system (EIS) for display, and control signals to actuators for control of pitch, roll, yaw, and engine thrust.
1.6.5 Electronic instrument system
The MD-11 EIS consists of six display units (DU) mounted in the instrument panel. DUs 1, 2, and 3 are on the left side; DUs 4, 5, and 6 are on the right side (see Figure 11). The captain's DUs (DUs 1, 2, and 3) receive display information from display electronic unit (DEU) 1, and the first officer's DUs (DUs 4, 5, and 6) receive information from DEU 2. DEU 3 (auxiliary) is continuously available as a spare and may be selected for use by either pilot through the EIS source input select panel.
DUs 1 and 6 normally display primary flight information, such as heading, attitude, airspeed, barometric and radio altitude, vertical speed, vertical and lateral deviation, aircraft operating limits, configurations, and flight modes.
DUs 2 and 5 are normally navigation displays (ND). The ND has four modes of operation as follows:
- MAP mode–Displays the active flight plan referenced to the aircraft position and heading in the form of a pictorial representation; this is the mode normally used with FMS navigation.
- PLAN mode–Displays the flight plan only, with the aircraft symbol centred on the next waypoint.
- VOR mode–Displays a compass rose, two bearing pointers (for non-directional beacons (NDB) and very high frequency omni-directional range (VOR)), a course deviation indicator (for VOR navigation and approaches), headings, ground speed, true airspeed (TAS), distance measuring equipment, and weather information; this mode is normally used for conventional (NDB and VOR) navigation and approaches.
- APPR mode–Displays the same information as the VOR mode, except that the course source is an ILS receiver instead of a VOR; this mode is used for ILS front-course and back-course approaches.
All the modes display wind, clock, and next waypoint information.
DU 3 is normally used to show the engine and alert display (EAD), which includes information such as engine pressure ratio (EPR), exhaust gas temperature, N1,Footnote 23 N2,Footnote 24 fuel flow, and alert messages. DU 4 is used for the system display (SD), which normally shows either secondary engine data (i.e., engine oil temperature, pressure and quantity), or aircraft systems synoptic pages.Footnote 25 The synoptic pages display the configuration and status of the hydraulic, electric, air, and fuel systems. They also include a configuration page, miscellaneous page, systems status page, and a consequence page (see Table 6).
Electrical power is supplied by the left emergency 115 volts (V) alternating current (AC) bus for DUs 1 and 3; by the right emergency 115 V AC busFootnote 26 for DUs 4, 5, and 6; and by the 115 V AC Bus 1 for DU 2. If all three engine-driven electrical generators were to fail, DU 1 and DU 3 would automatically receive electrical power from the aircraft battery. When the air-driven generator (ADG) is deployed and selected to the electric mode, DUs 1, 3, 4, 5, and 6 can be powered, and the aircraft battery charge will be maintained.
If flight information data to the DU is invalid, that information is removed from the screen and replaced by either a red or amber "X" symbol covering the area of removed data. A red "X" requires immediate flight crew action to restore the lost data. If the "X" is amber the flight crew can decide to delay action to restore the data. A failed DEU is indicated by a red "X" displayed across the entire black screen of the DU. The loss of electrical power to a DU will result in a blank screen. The loss of any DU would cause the remaining DUs to reconfigure automatically. The priority logic used in reconfiguring is to keep a primary flight display (PFD) available at all times; that is, if only one DU were functioning, it would maintain the PFD. In the failure priority logic, the second-to-last operating DU would display the EAD.
1.6.6 Flight management system
The FMS is used for flight planning, navigation, performance management, aircraft guidance and flight progress monitoring. The FMS provides a means for the flight crew to select various flight control modes via the FCP, and the means to enter flight plans and other flight data via the multifunction control display unit (MCDU) (see Figure 11). Flight progress is monitored through the MCDU and the EIS.
After data entry by the flight crew, the FMCs will generate a flight path profile; for example, from the origin airport to the destination airport. The FMC then guides the aircraft along that profile by providing roll commands, mode requests, speed and altitude targets, and pitch commands (while "on path" during descent) to the FCCs.
The FMC navigation database includes most of the information that is available to pilots from navigation charts and approach charts. The flight plan that was entered into the FMS before departure from JFK airport in New York did not include the Halifax International Airport. Therefore, when the pilots decided to divert and land at the Halifax airport, some reprogramming of the FMS would have been required. Before the pilots could select an instrument approach from the FMC database, the new destination of Halifax would have to be programmed into the FMS.
The MD-11 is not certified to conduct back-course approaches using the FMS. The FMS will prevent the display and selection of back-course approaches from the navigation database.Footnote 27 Conventional navigation and approach methods are available to the flight crew.
1.6.7 Warnings and alerts
The MD-11 alerting system incorporates master warning and master caution lights on the glareshield. Alerts are displayed in the cockpit on the EAD, the SD, or both. Alerts are categorized into four levels (3, 2, 1, and 0) and are presented in three columns in the lower third of the EAD.
Level 3 (red) alerts indicate emergency operational conditions that require immediate flight crew awareness and immediate corrective or compensatory action by the pilots. All Level 3 alerts have an aural warning. Level 2 (amber) alerts indicate abnormal operational system conditions that require immediate flight crew awareness and subsequent corrective or compensatory action by the pilots. Level 1 (amber) alerts may require a maintenance action prior to take-off, a logbook entry, or confirmation of desired system configuration. A Level 1 (amber) alert in flight may require flight crew action as prompted, and requires an aircraft logbook entry. Level 0 (cyan) alerts usually indicate operational or aircraft systems status information.
If a system generates an alert or warning, the applicable cue switch on the system display control panel (SDCP) illuminates, enabling the pilots to identify the system. Activating the illuminated system cue switch on the SDCP produces the associated system synoptic page on the SD, and extinguishes the cue light, master warning, and caution lights, if they are on. Table 6 shows available cue switches and their associated systems synoptic page.
|Cue switch||Associated systems synoptic page|
|CONFIG||flight controls and landing gear|
|MISC||alerts and consequences for various miscellaneous systems|
The FDR revealed that the air system synoptic page (Air Page) was selected by the pilots sometime between 0111:49 and 0112:52, shortly after the unusual odour was first detected in the cockpit. This page displays environmental system operation of the manifolds, duct temperatures, zone temperatures, smoke and heat detectors in the cargo compartments, pressurization readouts, bleed-air readout, and air conditioning pack readouts. Aside from the flight crew selection of the Air Page, the FDR records only the following potentially related data: air packs 1, 2, and 3 OFF; aft and forward cargo heat; bleed-airs 1, 2, and 3 OFF; cabin pressure warning; and cabin altitude warning. The FDR does not record individual duct or zone temperatures, cabin smoke, lavatory smoke, or any system cues displayed on the SDCP.
1.6.8 Standby flight instruments
Two standby flight instruments (one that displays the aircraft's attitude, and one that displays the aircraft's altitude and airspeed) are located in the centre of the lower instrument panel for use by the captain or first officer (see Figure 11). There was no provision for a self-contained, independent electrical power supply for standby communication and electronic navigation capability, nor was this required by regulation.
The standby attitude indicator (SAI), sometimes referred to as a gyro horizon, provides a vertical, stabilized reference that makes it possible to visually monitor the aircraft's attitude, in pitch and roll, with respect to the horizontal plane. The SR 111 SAI was self-contained and electrical power was being supplied by the aircraft's battery bus. A warning flag appears on the face of the instrument if electrical power to the unit is lost or removed, or if the gyro speed decays to a predetermined speed below which the gyro has insufficient rotational speed to provide reliable information.
The standby altimeter and airspeed indicator are combined in one instrument. They are connected to the auxiliary pitot and alternate static systems, and do not require electrical power to perform their intended function; electrical power is required for the vibrator that prevents the pointers from sticking.
Primary power for the two standby instruments' integral lights was being supplied by the 115 V AC Bus 1 (phase B) circuit breaker (CB) B-523 (labelled MAIN & PED INSTR PNL LTG) located on the lower main CB panel at position A-13. The wiring for the primary electrical power circuit integral lights runs below the cockpit floor and not through any area where heat damageFootnote 28 was observed; therefore, there is no reason to suspect that these lights ceased to function. Back-up electrical power for the integral lights was supplied by the left emergency AC bus.
A direct-reading, standby magnetic compass (see Figure 11) is installed in the cockpit forward of the overhead panel on the windshield centre post. The instrument does not require electrical power to operate. Electrical power for lighting of the compass was supplied by the 28 V direct current (DC) Bus 1. The switch for the compass light is on the overhead switch panel, near the compass. The standby compass is normally kept in a stowed position with the light off. As is the case with all direct-reading magnetic compasses, the accuracy of the instrument in the MD-11 is degraded when the aircraft is accelerating or decelerating, and when the aircraft is not in straight and level flight.
1.6.9 Communications systems
For external communications, Swissair MD-11 aircraft are equipped with five separate radios, plus an emergency hand-held very high-frequency (VHF) radio stored in a bracket mounted on the cockpit rear wall. The five radios comprise three VHF radios and two high-frequency (HF) radios, all of which are controlled through communication radio panels installed in the aft pedestal between the two pilots seats.
Internal voice communication between the pilots is either spoken directly or through boom microphones attached to headsets. Each flight crew oxygen mask has a built-in microphone that is activated with a push-to-talk rocker switch. One position of the rocker switch is used for internal communication, and the other position is used for transmitting over the external VHF and HF radios. Additional internal communication is provided through a flight interphone system that connects all cabin attendant stations and the cockpit, and a passenger address (PA) system that enables the pilots and cabin crew to address passengers throughout the cabin and in the lavatories.
The ambient noise in the MD-11 during high-altitude cruise flight is low enough so that pilots typically do not need to use the headsets and boom microphones for internal communications. Swissair policy requires flight crews to use this equipment for flight below 15 000 feet. There are regulatory requirements in some jurisdictions that mandate the use of this equipment below certain altitudes. For example, US FAR part 121.359 (g) mandate their use below 18 000 feet for aircraft equipped to record the uninterrupted audio signal received by a boom or mask microphone in accordance with FAR part 25.1457 (c)(5). Canadian Aviation Regulations (CARs) (CAR 625.33 II (5) refers) require their use below 10 000 feet.
220.127.116.11 Interphone call system
The aircraft was equipped with an interphone call system to facilitate aircraft crew communication. In Swissair MD-11s, handsets, call buttons, and reset switches are installed at nine stations throughout the aircraft: one in the cockpit and one at each flight attendant station. Calls can be initiated from any flight attendant station to the cockpit; from the cockpit to any, or all, flight attendant stations; and from any flight attendant station to any, or all other, flight attendant stations.
The interphone call system provides both aural and visual signals to alert crew members to a station call. A visual alert is provided by the illumination of indicating lights in the reset switches. In the passenger cabin there is an additional visual alert through the use of pink call lights. At the associated area master call display, these lights would illuminate to indicate the initiation of a "pilot-to-flight-attendant" or "flight-attendant-to-flight-attendant" call. When the call button is pushed, two electro-mechanical chimes, one above the left and one above the right attendant station emit a single-stroke chime.
All cabin interphone conversations are recorded on a single cockpit voice recorder (CVR) channel. The CVR recording does not indicate which station is being used.
18.104.22.168 Aircraft communications addressing and reporting system
The occurrence aircraft was equipped with an aircraft communications addressing and reporting system (ACARS), which is a two-way digital communications link between the aircraft and the operator's flight operations centres. Typically, when the aircraft is within VHF radio range of a ground station the ACARS uses the aircraft's VHF 3 radio to communicate through a network system. See the supporting technical information on this topic
The ACARS switches automatically to communicate through a satellite communications (SATCOM) system when the aircraft is out of range of VHF ground stations, VHF coverage is interrupted through saturation of the system, or the VHF 3 radio in the aircraft is switched to voice mode. When VHF coverage is available, VHF is the primary path for data exchange. The SATCOM system also provides satellite telephone service available to all aircraft occupants.
The ACARS provides a means to automatically report flight information, such as engine parameters and load data, and to track aircraft movements, such as take-off and landing times. The pilots can also use the ACARS to obtain information, such as weather reports, and to exchange free-text messages.
Swissair's main service provider for the ACARS was Société Internationale de Télécommunications Aéronautiques (SITA). All communications to and from the aircraft through SITA were routed through the SITA Swissair host in Zurich. Where SITA was not able to maintain coverage, they subcontracted to Aeronautical Radio Inc. (ARINC), which is the main service provider in the USA, and to the International Maritime Satellite Organization (INMARSAT) for satellite coverage.
1.6.10 Electrical system
Normal primary electrical power is generated by three, engine-driven, integrated-drive generators (IDG). An auxiliary power unit (APU) generator is also available as a back-up source of electrical power in certain ground or flight phases. The three IDGs supply electrical power to their respective generator buses,Footnote 29 which in turn supply electrical power to several sub-buses located throughout the aircraft. Electrical power distribution is normally automatic; however, if necessary, the pilots can control the electrical system manually with controls located on the overhead switch panel.
The following definitions are used throughout the report. They are based on the Society of Automotive Engineers' (SAE) Aerospace Standard AS50881, Rev. A, entitled Wiring, Aerospace Vehicle:
- Wire: A single metallic conductor of solid, stranded, or tinsel construction designed to carry current in an electric circuit, but not having a metallic covering, sheath, or shield. For the purpose of this report, "wire" refers to "insulated electric conductor."
- Cable: Two or more wires contained in a common covering, or two or more wires twisted or moulded together without a common covering, or one wire with a metallic covering shield or outer conductor.
- Wire bundle: Any number of wires or cables routed and supported together along some distance within the aircraft.
- American Wire Gauge (AWG): A standard set of non-ferrous wire conductor sizes. "Gauge" is based on diameter. The higher the gauge number, the smaller the diameter and the thinner the wire.
22.214.171.124 Air-driven generatorST
The ADG is an air-powered turbine that drives an electrical generator. The ADG is manually deployed via a lever in the cockpit; once deployed, it cannot be retracted in flight. The ADG is located on the lower right-hand side of the fuselage to the right of the nose gear doors.
When deployed, the ADG automatically supplies hydraulic power for the flight controls by electrically powering auxiliary Hydraulic Pump 1. With a switch on the electrical system control panel (SCP), the pilots can switch the ADG to an electrical mode of operation. In doing so, the ADG supplies emergency electrical power that operates instruments and communication equipment. In this configuration, electrical power is no longer supplied to auxiliary Hydraulic Pump 1; in the absence of primary power, the pump will cease to operate.
On the occurrence aircraft, the ADG was stowed at the time of impact. There would have been no requirement to deploy the ADG unless electrical or hydraulic power or both were unavailable from other sources. Information derived from the examination of various system components indicates that, at the time of impact, electrical and hydraulic power were available from sources other than the ADG.
126.96.36.199 Emergency electrical power isolation
For the purpose of isolating a source of smoke, electrical power can be shed in sequence from the electrical buses through the four-position SMOKE ELEC/AIR selector located on the overhead electrical control switch panel (see Figure 11). This selector allows for the isolation of electrical or air conditioning systems that could be the source of fumes or smoke.
The selector must be pushed in and rotated clockwise to move it to the next position. The selector cannot be turned counter-clockwise. As the selector is rotated, electrical power is returned to the systems associated with the previous position prior to shutting off electrical power associated with the new selector position. If the selector is rotated through to the NORM position, all electrical power from the three generator systems is returned, and the three air systems are restored.
188.8.131.52 Cockpit circuit breaker panels
There are nine separate CB panels in the cockpit; the five most pertinent to this investigation are the overhead CB panel, the upper and lower avionics CB panels, and the upper and lower main CB panels (see Figure 12). The remaining four are the captain's and first officer's console CB panels, the centre overhead integral lighting CB panel, and the lower maintenance CB panel.
The overhead CB panel contains wiring from the following six separate buses:
- 28 V DC battery bus;
- 28 V DC battery direct bus;
- left and right emergency AC buses; and
- left and right emergency DC buses.Footnote 30
The upper avionics CB panel contains wiring from the following seven separate buses:
- 115 V AC buses 1 and 3;
- 28 V DC buses 1 and 3; and
- 28 V AC 1, 2, and 3 instrument buses.
The lower avionics CB panel contains wiring from the following two separate buses:
- 28 V DC Bus 2; and
- 28 V DC ground bus system.
The 28 V DC ground bus system CBs, installed on the lower avionics CB panel, were all 0.5 ampere (A) CBs used for indication and control of their respective remote control CBs. The 28 V DC Bus 2 consisted of three, 3 A and one, 5 A CBs. A jumper wire from the line side of the "SLAT CONTROL PWR B" CB, which was a 3 A CB, was used to provide 28 V DC to a 1 A CB used to power the IFEN control relays. The four, 115 V AC three-phase power supply 15 A CBs for the IFEN were installed in the lower avionics CB panel.
The upper and lower main CB panels contain wiring from both the 115 V AC and 28 V DC buses 1, 2, and 3.
The standard used by the aircraft manufacturer for CB identification was to identify each row by a letter, and each column by a number. This methodology was used to identify the location of individual CBs on the panel.
184.108.40.206 Overhead circuit breaker panel bus feed wires
These bus feed wires were routed through five conduits that were installed along the right side of the fuselage, from the avionics compartment to approximately halfway up the fuselage side wall. In the cockpit, outside of the conduits, the bus feed wires were individually clamped to wire support brackets that were attached to the aircraft structure by nylon standoffs. The individual wires were bundled together, just prior to entering the right side of the overhead CB panel. Table 7 describes the bus feeds.
|Bus feed||Right emergency AC bus, phases A, B, and C||28 V DC battery direct and battery buses||Left emergency AC bus||Right emergency DC bus||Left emergency DC bus|
|Wire harness number||ABS9208||ABS9206||ABS9205||ABS9206||ABS9205|
|Wire run letter||ALB||ALN||ALC||ALP||ALE|
|Wire size||3–#8AWG||1–#8AWG 1–#6AWG||1–#10AWG||1–#6AWG||1–#6AWG|
|Function||115 V right emergency AC bus, Phases A, B, and C||28 V DC battery direct and battery buses||115 V left emergency AC bus||28 V right emergency DC bus||28 V left emergency DC bus|
220.127.116.11 Upper and lower avionics circuit breaker panel bus feed wires
The 115 V AC bus feeds originate in the Centre Accessory Compartment and the 28 V DC bus feeds originate from the avionics compartment. The three 28 V AC instrument bus feed wires originate from instrument transformers that are mounted on the aft face of the cockpit wall. Primary electrical power to these transformers is supplied from the lower main CB panel 115 V AC buses 1, 2, and 3 respectively.
All of the bus feed wires supplying the avionics CB panel are routed from the right aft side of the cockpit wall, forward through a hole behind Galley 2, and then inboard to the avionics CB bus bars.
The HF Comm 1 requires a three-phase electrical power source to operate. As a result, two additional 115 V AC Bus 1 feed wires (phases B and C) are routed to the HF Comm 1 CB. Similarly, an additional DC Bus 2 feed wire is routed to two CBs: the AFCS MISC PNL LIGHTS and the PRIMARY HOR STAB TRIM. Table 8 describes the main bus feed wires and their run letters.
|Function||115 V AC
|115 V AC
|28 V DC
|28 V DC
|28 V AC
|28 V AC
|28 V AC
|Wire run letter||AEU||AEV||ASD||ASE||ASC||ASC||ASC|
18.104.22.168 Upper and lower main CB panel bus feeds
The upper and lower main CB panels receive electrical power from bus feed wires that are routed from the avionics compartment located below the floor; these bus feed wires were not routed through any area where heat damage was observed.
22.214.171.124 Wire identification, location, and routing
All McDonnell Douglas-installed wires in the MD-11 are identified by a wire number consisting of an alpha character followed by a numeric string (e.g., B203-974-24). The alpha character designates the aircraft section in which the wire is installed (see Section 126.96.36.199). The six digits that follow identify the individual wire number; the final two digits identify the wire gauge. Therefore, wire B203-974-24 indicates that the wire is installed in the B section, that its individual wire number is 203-974, and that it is a 24 AWG wire. An N suffix indicates a ground wire.
Typically, wires that are installed in aircraft are tied together in bundles called wire runs. Therefore, individual wires can be further referenced by identifying the wire run in which they are included.
In the MD-11, every wire run is identified by a three-letter designator, such as "FBC," which provides information about where and how the wire run is routed through the aircraft.
- The first letter indicates the location of the wire run in the aircraft. Letters A, B, C, R, Q, and S are used for the cockpit and nose area. Letters D, E, and H refer to the fuselage section below the floor. Letters F, G, and J refer to the cabin above the floor. The letter K identifies the right wing. The letter L identifies the left wing. Letters T and V identify the tail location.
- The second letter indicates whether the wire run is enclosed in a conduit or in an open wire bundle. The letters V, W, Y, and Z are used if the wire run is in a conduit; all other letters indicate an open wire bundle. The second letter also indicates the applicable RF interference category of the wires in the bundle.
- The third letter identifies the specific run.
Where practical, the wire number is directly marked on the outer insulation of each wire; otherwise, the wire number is affixed to the wire by tags at both the start and termination points. A wire may need multiple sets of run letters to completely describe its routing through the aircraft.
Once a wire number is known, it is possible to use the manufacturer's wire list to determine where the wire is installed in the aircraft. The wire list also provides information about the wire's composition, length, to-and-from termination points, circuit function, and wire run affiliation.
188.8.131.52 Wire description–MD-11 aircraft
184.108.40.206.1 Selection criteria for wires–Douglas aircraft company
In accordance with FAR 25.869, the only certification test required for aircraft wires is the 60-degree Bunsen burner test (see Section 220.127.116.11). Aircraft manufacturers typically perform additional wire tests to meet manufacturing and customer requirements, and select wire types based on a balance between the characteristics of the wire types available and the required application.
In 1976, Douglas Aircraft Company (Douglas) was informed by its wire supplier that the general purpose wire they were providing for the wide body aircraft program was going to be discontinued. Douglas initiated a wire evaluation program to select a new general purpose wire. The review included an assessment of various wire insulation types with respect to their electrical, mechanical, chemical, and thermal properties, along with their inherent flame resistance and smoke production characteristics. The evaluation resulted in two types of insulation being selected: a modified cross-linked ethylene-tetrafluoroethylene (XL-ETFE)Footnote 31 in accordance with Douglas specification BXS7008 and an aromatic polyimide,Footnote 32 hereinafter referred to as polyimide, in accordance with Douglas specification BXS7007.
Polyimide insulation was viewed as having favourable weight and volume characteristics. Also, it offers superior resistance to abrasion, cut-through, and fire. Polyimide does not flame or support combustion. The limitations of polyimide included less resistance to arc trackingFootnote 33 and less flexibility than other insulation types. Polyimide insulation is an amber-coloured film that is wrapped on the wire. In some cases, a modified aromatic polyimide resin coating was applied over the polyimide film to provide a suitable topcoat surface to allow the wire identification number to be directly marked on the wire. This topcoat appears dull yellow in colour.
In 1975, the FAA issued a Notice of Proposed Rulemaking (NPRM)Footnote 34 stating that for wire, the specific optical densityFootnote 35 requirement for smoke emission would be a value of 15 (maximum) within 20 minutes after the start of the test. Although this NPRM was expected to be adopted, it was terminated without affecting the existing rules. However, before the NPRM was terminated, Douglas testing showed that the polyimide insulation would pass the specific optical density test requirements and that the XL-ETFE would not.
Based on cost and other considerations, Douglas chose XL-ETFE for its BXS7008 general purpose wire insulation, and used XL-ETFE in the DC-10. At the same time, polyimide insulation in accordance with BXS7007 was selected for the pressurized passenger section primarily because it produced less smoke when exposed to heat or flame compared to XL-ETFE. Polyimide could also be used in special applications, such as in locations where the temperature exceeded 150°C (302°F), whereas XL-ETFE was not rated for such temperatures.
In the early 1980s, a crimping problem was discovered with wires that had XL-ETFE insulation and tin-coated copper conductors. Because of this, Douglas decided to switch to nickel-coated conductors, even though they were more expensive. Subsequently, XL-ETFE lost its cost advantage, and Douglas switched to polyimide-insulated, nickel-coated conductors for all its general purpose wire.
In 1991, a US Air Force wire evaluation program identified a suitable general purpose wire replacement. It was a composite insulation made from polytetrafluoroethylene-polyimide-polytetrafluoroethylene (PTFE-PI-PTFE). That same year, Douglas initiated another wire evaluation program, using the polyimide general purpose wire as its baseline for comparison testing of other wire insulations types. The testing showed that the PTFE-PI-PTFE insulation performed as well as or exceeded the polyimide insulation; Douglas selected the PTFE-PI-PTFE insulation, in accordance with DMS 2426, for its general purpose wire in 1995.
Table 9 shows the comparative properties of four wire insulations.
|Relative ranking||Most desirable -------- to -------- Least desirable|
|CreepFootnote 37 (at temperature)||PI||COMP||PTFE||ETFE|
|Arc propagation (arc tracking) resistance||PTFE||ETFE||COMP||PI|
- PI–MIL-W-81381/7 (aromatic polyimide)
- COMP–MIL-W-22759/80-92 (PTFE-PI-PTFE)
18.104.22.168.2 MD-11 wire specification
Douglas identified the following two general purpose wire specifications for the MD-11: BXS7007 and BXS7008 (see Figure 13). These wire specifications adopt by reference, unless otherwise indicated, certain government-furnished documents, including Military Specifications and Standards and Federal and Industry Standards, as well as certain Douglas Material and Process Specifications. BXS7007 and BXS7008 also establish performance and test requirements that the wires must meet in addition to those adopted from the referenced documents, including, for example, the 60-degree burn test required by FAR 25.869.
BXS7007 specification is entitled "Wire, Electric, Copper & Copper Alloy, Polyimide Tape Insulated, 600 Volt." This specification covers wires and cables that must pass all the applicable performance and test requirements for the specified gauges as defined in MIL-W-81381, MIL-W-81381/12, and MIL-W-81381/14, as well as MIL-W-27500 and other referenced documents, unless otherwise indicated in the specification. Douglas started using the BXS7007 wire in production aircraft in 1980.
Wires that conform to BXS7007Footnote 38 are polyimide insulated with nickel-plated conductors. All BXS7007 wire conforms to the requirements of MIL-W-81381/12 (in addition to other applicable requirements), except for 24 AWG wire, which is high-strength alloy that conforms to the requirements of MIL-W-81381/14 (in addition to other applicable requirements). All BXS7007 wire is rated at 200C, 600 volts. The temperature rating refers to the maximum temperature in which the wire may be used, and is derived by combining ambient and wire-generated heating.
BXS7008 specification is entitled "Wire, Electric, General Purpose, Copper & Copper Alloy, Fluoropolymer Insulated."Footnote 39 This specification covers wires and cables that must pass all the applicable performance and test requirements for the specified gauges as defined in MIL-W-22759, MIL-W-22759/34, and MIL-W-22759/42, as well as MIL-W-27500 and other referenced documents, unless otherwise indicated in the specification (see Figure 13). Douglas started using the BXS7008 wires in production aircraft in 1977.
Wires that conform to BXS7008 are insulated with modified, XL-ETFE. BXS7008 requires that the insulation be applied or extruded on the conductor in two layers of contrasting colour to aid in the identification of insulation damage. Wires 22-00 gauges are tin-coated copper. These wires must conform to MIL-W-22759/34 and are rated at 150°C, 600 volts. BXS7008 24 gauge wire is nickel-coated high-strength copper alloy. This wire must conform to MIL-W-22759/42 and is rated at 200°C, and 600 volts.
MIL-W-27500, which is one of the documents adopted in both BXS7007 and BXS7008 unless otherwise indicated, covers requirements for special purpose cables and electrical power cables, including the basic wire size and type, number of wires, and shield and jacket styles. BXS7007 and BXS7008 also adopt documents requiring identification coding of wires.
In the areas of SR 111 where the fire occurred, it is estimated that more than 95 per cent of the wiring installed at the time of manufacture was BXS7007 (i.e., polyimide insulated wire). Douglas also used various other types of wire, in small amounts, where a specific requirement existed.
1.6.11 In-flight entertainment network
The IFEN system combined computer, video, and audio technologies to allow passengers to select movies, audio, games, news, gambling, and the moving map display through an interactive seat video display. The IFEN was to be configured to give all passengers access to a variety of "on-demand" entertainment and information choices, with touch-screen control. The original design, for the Swissair MD-11, provided full IFEN access to 257 passenger seats, which included all cabin classes; however, only the first two aircraft were configured to have the IFEN available in all 257 seats. For economic reasons, in April 1997, Swissair decided to reduce the IFEN configuration to include only first- and business-class seats.
The IFEN system was installed in the first- and business-class passenger sections of HB-IWF between 21 August and 9 September 1997 (see Figure 14). Although the 49 business-class seats were installed at that time, because of delivery delays, the 12 IFEN-equipped first-class seats were not installed until February 1998. The economy-class passenger section was not configured with the IFEN, even though electrical cabling and equipment rack supports were installed for that section. HB-IWF was the eighth Swissair MD-11 to be equipped with the IFEN system.
22.214.171.124 Wiring installation
The IFEN system, as configured in HB-IWF, required 4.4 kilovolt-amperes of 115 V AC three-phase 400 hertz aircraft power according to the Hollingsead International (HI) electrical load analysis (ELA) 20032 revision (Rev) B. The main power supply cable for the IFEN system consisted of three 8 AWG, MIL-DTL-16878/5-BNL wires twisted together. This cable originated at an electrical terminal strip located in the avionics compartment and was terminated at a 15 A three-phase CB located on the lower avionics CB panel (see Figure 14 and Figure 15). This 15 A CB, identified as "RACK1 PS1," provided aircraft power by means of jumper wiresFootnote 40 to three adjacent 15 A three-phase CBs located on the lower avionics CB panel. Each of these four 15 A CBs provided aircraft power to one of the four IFEN power supply units (PSU). The PSUs used a series of capacitors and internal electronics to convert the 115 V AC aircraft system power to 48 V DC output power, used by the IFEN system components.
Each of the four 15 A IFEN CBs was connected to its respective PSU by one of four PSU cable assemblies, hereinafter referred to as PSU cables; each PSU cable consisted of three 12 AWG, MIL-W-22759/16/12 wires twisted together.
Additionally, a 1 A CB was installed on the lower avionics CB panel. The CB provided 28 V DC power, by means of a 16 AWG wire (hereinafter referred to as 16 AWG control wire), to the IFEN relay assembly located in the ceiling above Galley 8. This 1 A CB, identified as "IFT/VES 28V," received 28 V DC aircraft power by means of a jumper wire from the line side of the adjacent CB, "SLAT CONTROL PWR B," and was used to control the 48 V DC output of the four PSUs through the IFEN relay assembly. Pulling this CB removed the 48 V DC output power from the PSUs; however, pulling the CB would not remove the 115 V AC input power to the PSUs.
The four IFEN PSU cables (PSU 1, 2, 3, 4) and the 16 AWG control wire were routed rearward along the lower avionics CB panel. In this area, they were attached to the main IFEN power supply cable with nylon self-locking cable ties. This IFEN wire bundle was then cable tied to the DC CB ground bus bar at the lower avionics CB panel and, in some installations, held in place near the rear of the panel by a clamp. The wire bundle was then directed upward until it separated in two directions. The main power supply cable looped downward, passing through a conduit along the right side of the fuselage into the avionics compartment. The four PSU cables and the 16 AWG control wire, now in their own bundle, continued upward as a single bundle near the avionics disconnect panel.
Following the SR 111 occurrence, the IFEN installation was examined in 15 Swissair MD-11s. It was noted that the routing of the bundle containing the PSU cables and the 16 AWG control wire varied among aircraft behind the avionics CB panel. None of these variations were considered to affect the immediate safety of flight. There were differences in how frequently this bundle was supported by any of the three horizontally mounted wire support brackets available, and in the methods used for fastening it to the brackets. Also, some installations had protective sleeving installed adjacent to the brackets, while others did not.
Near the avionics disconnect panel, the IFEN wire bundle was routed aft into one of the 102-cm (40-inch) long conduits that were installed above Galley 2 (see Figure 4 and Figure 5). In 11 of the examined Swissair MD-11s, the wire bundle was routed to pass in front of the avionics disconnect panel, and in three of those 11 installations, the bundles were then routed through the outboard conduit. In 4 of the examined aircraft, the bundle was not routed in front of the avionics disconnect panel; instead, it was routed close to the cockpit wall. In 2 of the 4 installations, the bundle was then routed through the outboard conduit. In total, 5 of the aircraft had the IFEN wire bundle routed through the outboard conduit, and 10 had the bundle routed through the middle conduit.
In the occurrence aircraft, it could not be determined from the IFEN installation documentation how the IFEN wire bundle had been routed in the area of the disconnect panel, or which conduit had been used in the area above Galley 2. The IFEN installers preferred to use the middle conduit where possible, but in the five instances noted above, the middle conduit was not available as it had been used for aircraft wiring. In the sequence of IFEN installations, the middle conduit had been used in the three aircraft prior to HB-IWF, and also in the seven aircraft following HB-IWF.
The investigation was not able to establish from the manufacturer's records which conduit might have been left unused in HB-IWF (SN 48448). In the aircraft built immediately before HB-IWF (HB-IWE–SN 48477), the middle conduit was used for the IFEN wire bundle. In the next Swissair aircraft built after HB-IWF (HB-IWG–SN 48452), the outboard conduit was used for the IFEN wire bundle.
The conduit material, based on DMS 2024 Revision B, was Type 1, convoluted, thin wall, fluorinated ethylene-propylene (FEP). The installation of the wire bundle, from where it exited the aft end of the conduit to approximately STA 515, also varied between aircraft. The wire bundle was found to be routed either above or below the upper horizontal angle support bracket for the R1 door ramp deflector, above or below the wire supports, and was clamped to either the top or bottom of these supports or to existing aircraft wiring. Where the IFEN cables were attached to existing wire harnesses, spacers were installed to provide separation between the wire bundles. Additionally, some of the aircraft had protective sleeving installed over the wire bundle in the area near the R1 door ramp deflector upper support.
The wire bundle continued rearward until the PSU 1 and 2 cables were separated from the bundle and terminated at an IFEN electronics rack (E-rack) 1. E-rack 1 was located in first class above the right aisle, with its forward support located at STA 647.
The 16 AWG control wire continued rearward, then crossed over the aircraft crown at approximately STA 750, and was terminated at the relay assembly mounted above Galley 8. This relay assembly received all of the external interfaces to the aircraft system including the following: the decompression signal, which removed power from the IFEN if the aircraft became depressurized; the PA system override signal, which was designed to stop all audio and video on the IFEN system whenever the PA was used; and the 28 V DC power input supplied by the "IFT/VES 28V" 1 A CB. Removal or loss of this 28 V DC power caused an "On/Off" relay, located within the relay assembly, to disable the output of all the PSUs.
The PSU 3 and 4 cables continued rearward until crossing over the aircraft crown at STA 1239. They were then routed rearward along the left side of the fuselage and terminated at E-rack 2. E-rack 2 was located in economy class above the left aisle, with its forward support located at STA 1429.
126.96.36.199.1 Wire description
The primary wire type selected for the IFEN system installation was MIL-W-22759/16, an extruded ethylene-tetrafluoroethylene (ETFE) copolymer insulation, medium weight, tin-coated copper conductor, rated at 150°C, 600 volts. (See Figure 13.) Additionally, the wires used for the main power supply cable were MIL-DTL-16878, an extruded polytetrafluoroethylene (PTFE) insulation, copper-coated copper conductor, rated at 200°C, 1 000 volts. The MIL-W-22759/16 wire had a maximum temperature rating of 150°C.
The 28 V DC wire, from the 1 A CB in the lower avionics CB panel to the IFEN system relay assembly, was specified as 16 AWG MIL-W-22759/16.
Each IFEN PSU power cable consisted of three, 12 AWG, MIL-W-22759/16 wires twisted together. For circuit identification purposes, MIL-C-27500 specification required the wires for each cable to be coloured white, blue, and orange. The cable was to be labelled using identification markers as called out in an HI drawing.
The main IFEN power supply cable consisted of three, 8 AWG, MIL-DTL-16878/5-BNL wires twisted together as called out in an HI drawing. This drawing also stated that the wire will not be identified by printed marking on the outside of the wire. MIL-DTL-16878/5-BNL specifies an extruded PTFE, maximum rating of 200°C, 1 000 volts. For circuit identification purposes, MIL-C-27500 specification required the wires for each cable to be coloured white, blue, and orange. However, a red wire was substituted for the blue wire in the installation, which had no affect on the performance of the wire. Samples of each 8 AWG coloured wire were analyzed by Fourier Transform Infrared Spectroscopy and identified as PTFE with a melting point of 323°C; this was determined by differential scanning calorimetry.
E-rack 1 contained the following components (see Figure 14):
- PSUs 1 and 2 that supplied 48 V DC power to CB Unit 1, which distributed 48 V DC power to the components mounted in E-rack 1;
- Two electromagnetic interference (EMI) filter boxes, one attached to each PSU. The filters were connected between the power supply input and the PSU, and were designed to filter out conducted EMI from the aircraft power supply;
- Two 32-channel modulators, which converted the baseband video and audio input signals to broadband RF output signals;
- A video on demand (VOD), which extracted, selected, and distributed the movie/music data;
- A disk array unit, which stored the digitally encoded programming;
- A 13-channel modulator, which performed the same function as the 32-channel modulator, as well as distributed common video/audio information, such as the moving map system, to the entire aircraft;
- Two head-end distribution units, which combined the separate modulator outputs then split the output four ways; and
- Six cluster controllers, which coordinated all the computer network administrative tasks.
The VOD was also equipped with a removable disc pack to permit maintenance personnel to upload movies.
E-rack 2 contained the following:
- PSUs 3 and 4 that supplied 48 V DC power to CB Unit 2, which distributed 48 V DC power to the components mounted in E-rack 2;
- EMI filters 3 and 4; and
- A network switching unit, which provided network links for the IFEN administrative network.
Each first- and business-class seat was equipped with an interactive video seat display that included a touch screen and magnetic card reader; a seat electronics box, which processed all information for the passenger interface; and a dual audio/game-port, which controlled the games and audio. In addition, each set of first- and business-class seats was equipped with a seat disconnect unit, which contained the tuner and network repeater.
A cabin file server, located on a rack in Galley 8, controlled the download of movies, stored flight/casino information, and collected the credit card data transmitted from each seat. Galleys 1 and 8 were fitted with a management video display (MVD). The MVD provided an interface for cabin crew and maintenance personnel, and served as a point of control for configuring, maintaining, and monitoring the IFEN. Each MVD was equipped with a management terminal electronic box, the primary functional component interface to the IFEN by the flight crew and maintenance personnel. A printer was also located in Galley 8.
1.6.12 Aircraft fire protection system
While no zone of an aircraft is immune to in-flight fires, fire protection systems used in transport category aircraft have evolved based on the probability of fire ignition within particular zones of the aircraft. These aircraft are equipped with a variety of built-in detectors and, in some cases, associated suppression systems designed to assist the aircraft crew in identifying and extinguishing an in-flight fire. In accordance with FAA airworthiness certification requirements, the occurrence aircraft was equipped with built-in fire detection and suppression capabilities in the aircraft's designated fire zones (see Figure 2). FAR 25.1181 states that a designated fire zone includes engines, APUs, and any fuel-burning heater or combustion equipment. In addition, specific regions of the aircraft, such as cargo compartments and lavatories, have been identified as "potential fire zones"Footnote 41 that require various built-in detection and suppression capabilities.
The fire risk to the remainder of the pressure vessel was such that it did not have, nor was it required to have, built-in detection and suppression equipment. Therefore, the remaining zones of the aircraft were solely dependent on human intervention for both detection and suppression of an in-flight fire. For the purposes of this report, the remaining zones of the aircraft for which built-in detection and suppression are not specified are referred to as "non-specified fire zones."
188.8.131.52 Portable fire extinguishers
The aircraft was equipped with eight portable fire extinguishers, which were held by brackets mounted in designated locations and distributed throughout the aircraft. In the passenger cabin there were five, 2.5-pound (lb) bromochlorodifluoromethane (Halon 1211) fire extinguishers, and two 5-lb monoammonium phosphate (dry chemical) fire extinguishers. The cockpit contained one 2.5-lb Halon 1211 fire extinguisher held by a bracket mounted on the cockpit rear wall (see Figure 17).
Five of the six Halon 1211 extinguishers, and both dry chemical fire extinguishers, were recovered. It was not possible to determine where these extinguishers had originally been located in the aircraft, primarily because each extinguisher was identical in design, and there were no additional identifying features. Three Halon extinguishers exhibited markings indicating that they were still in their mounting brackets at the time of impact. Two of the three extinguishers still contained a charge of fire extinguishing agent. The pre-impact charge state of the remaining Halon 1211 extinguishers could not be determined, owing to punctures and other damage incurred at the time of impact.
One of the two dry chemical extinguishers showed marks indicating that it was in its mounting bracket at the time of impact. Its charge state at the time of impact could not be determined. The other dry chemical extinguisher was charged at the time of impact, with its locking pin intact; it could not be determined whether this extinguisher was in its mounting bracket at the time of impact.
184.108.40.206 Engine/APU/Cargo and lavatory fire extinguisher bottles
The aircraft was equipped with nine fire extinguishing bottles, containing bromotrifluoromethane (Halon 1301) in the engine, the APU, and cargo areas. Eight of the nine bottles were recovered. Fire handles, which control the activation of the engine fire bottles, were installed on the overhead panel in the cockpit. (See Figure 11.) When the fire handle is pulled and turned, electrically activated explosive cartridges rupture a frangible disc and the extinguishing agent is released from the bottles. The APU bottle is activated automatically when a fire occurs in the APU compartment. The cargo fire bottles are activated by push buttons in the cockpit.
There is no indication that any of these engine/APU/cargo fire extinguishing bottles were discharged by flight crew actions, although some bottles showed signs that they had been discharged by the explosive cartridges, most likely at the time of impact.
A total of four lavatory fire extinguishers were recovered; none could be identified as to its installed location. There was no soot or heat damage on any of the extinguishers. From the recorded information, there was no indication that any of the smoke detectors in the lavatories activated.
1.6.13 Flight control system
The MD-11 has a conventional flight control column and rudder pedal configuration for the captain and first officer. The primary flight control system comprises the inboard and outboard elevators, the inboard and outboard ailerons, and one upper and one lower rudder. The secondary flight control system comprises the inboard and outboard wing flaps and slats, the wing spoilers/speed brakes, and a controllable horizontal stabilizer.
All primary and secondary flight control surfaces are hydraulically powered by two aircraft hydraulic systems. Flight control positions are displayed, normally by DU 4, on the SD by selecting the configuration page with the CONFIG cue switch on the SDCP. In addition to the SD, flap and slat positions are also shown on the PFD. Alerts will appear on the EAD and the SD.
Other than the slats, which are electrically controlled and hydraulically actuated, the flight control system is designed with a direct mechanical/hydraulic interface consisting of cables that run between the cockpit controls and the various hydraulic actuators that move the control surfaces. Therefore, with the exception of the slats, the movement of the control surfaces does not depend on the availability of electric power.
220.127.116.11 Longitudinal stability augmentation system
The MD-11 incorporates a longitudinal stability augmentation system (LSAS) that enhances longitudinal stability through commands to the elevators in a series mode. The LSAS holds the existing pitch attitude of the aircraft whenever the sum of the captain's and first officer's column forces is less than two pounds. In the software version that was installed in the occurrence aircraft, below 15 000 feet, there is no LSAS input when the column force is above two pounds. Above 15 000 feet, the LSAS provides an additional pitch rate damping input when the control column force is above two pounds. Automatic pitch trim of the horizontal stabilizer is also operative in the LSAS mode.
The LSAS is inoperative whenever the autopilot is engaged or when the aircraft is below 100 feet above ground level (agl). With the LSAS inoperative and automatic pitch trim unavailable, manual pitch trim is available.
As part of the investigation, simulator flights were conducted below 15 000 feet to gain an appreciation of the flyability of the MD-11 with the LSAS inoperative. There were no noticeable controllability changes in the pitch control or flyability of the aircraft with the LSAS inoperative.
18.104.22.168 Flaps and slats
The flaps and slats are controlled by the FLAP/SLAT lever on the right-hand side of the cockpit centre pedestal. In normal operation, as part of the climb-out check, the pilots would pre-select 15 degrees of flap on the DIAL-A-FLAP wheel located on the right-hand side of the FLAP/SLAT lever. When the flaps are selected down they extend to the pre-selected setting (in the case of SR 111, 15 degrees); the slats normally extend whenever the flaps are extended.
At the time of impact, the flaps were extended to about 15 degrees, and the slats were retracted. The slat system incorporates overspeed protection, which prevents the slats from extending whenever the aircraft's speed is above 280 knots and the flaps are extended less than 10 degrees. The slat overspeed protection can also be overridden by selecting a flap extension of 10 degrees or more. The slat-extend function can also be overridden by pushing a SLAT STOW button, which is used in the event of either a slat disagree alert or the loss of hydraulic systems 1 and 3. There is no indication that either of these events occurred on the accident flight. The failure of the slats to extend was most likely the result of fire damage that led to an interruption in the electrical power supply to the slat control valves.
1.6.14 Fuel system
The fuel is stored in three main tanks and two centre auxiliary tanks (upper and lower). The three main fuel tanks are located in the wings. Tank 1 (in the left wing) and Tank 3 (in the right wing) are identical, each having a main compartment, and an outboard compartment called the tip tank. Tank 2 is located in the inboard portion of each wing, and the two halves are interconnected by a large diameter fuel line to tanks 1 and 3. The two centre auxiliary tanks are located in the interspar fuselage section and are interconnected to the main tanks via a fuel manifold. The engines normally receive fuel, under pressure, from their respective main tank; the APU receives fuel from Tank 2. Because engines 1 and 3 are located below the wings, they can draw fuel from the fuel tanks even if the electric fuel pumps become inoperative. Engine 2, being tail-mounted and higher than the main fuel tanks, needs fuel to be pumped to the engine to maintain normal engine operation. In the event of a total electrical failure, fuel pressure to Engine 2 can be maintained by the Tank 2 left aft fuel pump and the tail tank alternate pump, both of which are powered by the right emergency AC bus following deployment of the ADG. The MD-11 is also equipped with a tail fuel tank, located in the horizontal stabilizer. During flight, fuel is automatically transferred in and out of this tank as required to maintain an aircraft C of G that aerodynamically provides the most economical fuel consumption. Every 30 minutes while the tail tank temperature is above 2°C, fuel is automatically transferred from the tail tank to Tank 2 or the upper auxiliary tank. On this particular flight, Tank 2 would have been the tank receiving the tail fuel.
There are seventeen, 115 V AC motor-driven boost or transfer fuel pumps interspersed among the various tanks. All of these pumps are electrically powered by one of the three generator buses; the Tank 2 left aft and the tail alternate pumps are powered from the right emergency AC bus, which receives power from the ADG if normal generator power is lost. All the pumps are automatically controlled throughout the flight by the fuel system controller (FSC) depending on the required fuel schedule, which includes fuel load, fuel distribution, phase of flight, fuel dumping, water purging, weight and balance control, and engine cross-feed operation requirements. The FSC checks and maintains the fuel schedule to satisfy structural load requirements and transfers fuel to the appropriate tanks to ensure proper distribution. The pumps can also be operated in MANUAL mode or, in certain failure conditions, the FSC may automatically revert to MANUAL mode. In the MANUAL mode, a selected set of fuel pumps will automatically turn on and can be controlled individually by a push button selection on the fuel SCP.
Three cross-feed valves can be used in the event of a fuel system delivery malfunction. In the event of an engine feed pump failure, the associated cross-feed valve can be opened to direct fuel to that engine. In the event of a main transfer-pump failure, fuel can be transferred using the engine feed boost pumps by opening the associated cross-feed valve.
The auxiliary tank fill/isolation valve works in conjunction with the tail tank fill/isolation valve when fuel is automatically transferred in and out of the tail tank for C of G control. Both valves are open when fuel is being transferred into the tail tank. When fuel is being transferred out of the tail tank, the tail tank fill/isolation valve is closed. Depending on flight conditions and the quantity of fuel in the upper auxiliary tank, the auxiliary tank fill/isolation valve is either open or closed. An open valve directs fuel to the three main tanks; a closed valve directs fuel to the upper auxiliary tank.
22.214.171.124 Fuel status at departure
After refuelling at JFK airport, the occurrence aircraft had a fuel load of 65 300 kg of Jet A fuel. The flight plan indicated that SR 111 would use 1 000 kg for taxi, leaving a fuel load at take-off of 64 300 kg.
126.96.36.199 MD-11 fuel dumping system
The MD-11 has two fuel dump valves for dumping fuel overboard. There is one dump valve on the trailing edge of each wing, between the outboard aileron and outboard flap. Fuel dumping is initiated by selecting the DUMP switch on the fuel SCP in the cockpit. Selecting the DUMP switch activates the boost pumps, transfer pumps, and the cross-feed valves. The fuel dump rate is approximately 2 600 kg per minute, provided that all of the fuel pumps and both of the dump valves are functioning normally.
Fuel dumping will cease when the DUMP switch is selected again, when the aircraft gross weight reaches a weight that was pre-selected by the pilots through the FMS, or at any time the FUEL DUMP EMERGENCY STOP button is pushed. The FMS fuel dump default is set to the maximum landing weight of the aircraft: 199 580 kg. If a pre-selected weight is not set by the crew, fuel will be dumped until the aircraft weight reaches the default weight. Pilots do not normally pre-select a weight; they use the default setting as the desired dump weight. As a backup, each main fuel tank has low-level float switches that will stop fuel dumping from that tank when the fuel load in the tank reaches 5 200 kg.
Fuel dumping flow rates will be reduced if the SMOKE ELEC/AIR selector is selected while dumping is taking place. Fuel dumping had not started prior to stoppage of the FDR recording, and fuel dumping was not underway at the time of impact. If the SMOKE ELEC/AIR selector was selected during the last few minutes of the flight, any associated reduction in fuel dumping rate would not have been a factor in this occurrence.
1.6.15 Hydraulic system
Hydraulic power for the MD-11 is derived from three parallel, continuously pressurized systems. Each system is powered by two engine-driven hydraulic pumps. Different combinations of two of the three systems provide parallel power to each of the primary flight control actuators. Two back-up electrically driven hydraulic pumps are also available. If necessary, one of these pumps can be driven by electrical power from the ADG.
In the event of an in-flight engine shutdown, if the aircraft is in a take-off or land configuration (the flaps, slats, or landing gear are extended), hydraulic power is transferred automatically from an operating system to a non-operating system by reversible-motor pumps. In the cruise configuration, hydraulic power is not transferred.
During the investigation, various components of the hydraulic system were examined to determine whether any anomalies in the hydraulic system could have had an adverse effect on aircraft controllability. The shut-off valves associated with the reversible-motor pumps were found to have been closed at the time of impact when it would be expected that, given the configuration of the aircraft, at least one set of valves would have been open, allowing one of the reversible-motor pumps to operate.
Engine 2 was shut down by the pilots approximately one minute prior to the time of impact (see Section 1.12.9). The shutdown of Engine 2 and the loss of automatic hydraulic power transfer through a reversible-motor pump would have resulted in an eventual loss of, or reduction in, Hydraulic System 2 operating pressure. However, the functions of the primary flight controls operated by Hydraulic System 2 would have been picked up through a parallel operating system. Therefore, the anomaly would have had little or no adverse effect on aircraft controllability.
1.6.16 Cockpit windows
The aircraft has six windows in the cockpit, three on each side. The two front windows are referred to as the left and right windshields. The windows immediately aft of the windshields are referred to as the left and right clearview windows; these can be manually opened under certain conditions. The two windows behind the clearview windows are referred to as the left and right aft windows.
All of the windows have imbedded electrical heating elements that are designed to prevent fogging on the inside of the window. The two windshields have additional electrical heating elements to prevent ice from forming on the outside. All of the windows have temperature sensors that allow the heating elements to be controlled from the windshield anti-ice panel located in the overhead control panel.
The controllers and sensors maintain the correct temperatures for anti-icing and defogging. The controllers automatically provide a gradual increase in heating to avoid thermal shock, and will remove electric power if an overheat condition occurs. An alert will be displayed on the EAD if any part of the system is not operative or if overheating occurs.
1.6.17 Landing gear
The MD-11 has four landing gear assemblies: two main gear, a centre gear, and a nose gear. The two main landing gear retract inward; the centre main landing gear and the nose landing gear retract forward. The landing gear is hydraulically operated. Normal gear extension and retraction is provided by Hydraulic System 3.
All four landing gear assemblies were in the retracted position at the time of impact. The right main landing gear displayed greater overall damage than did the left main landing gear.
1.6.18 Aircraft interior lighting
188.8.131.52 Cockpit and passenger cabin normal lighting
The MD-11 cockpit lighting includes overhead fluorescent lamps for area lighting, flood lights to illuminate the instrument panels, and integrally lighted panels. The cockpit also has supplemental lighting that includes flight crew reading lights (map lights), floor lights, and briefcase lights. The intensity of most of the lights can be controlled by rotary dimmer switches.
Lighting in the cabin includes overhead and side wall fluorescent light assemblies, as well as incandescent light assemblies that provide overhead aisle lighting and door entry lights. Cabin lights can be controlled from the cabin attendant stations.
184.108.40.206 Emergency lighting, battery packs, and battery charging system
The MD-11 has an emergency lighting system that illuminates the cockpit and the cabin. The system includes ceiling lights in the cockpit, as well as overhead aisle lights, cabin door handle lights, exit sign lighting, and floor escape path lighting in the cabin.
The emergency lighting system consists of the lighting network and six battery packs, each with a battery charger and control logic that determines the power source. The system, including battery charging, is normally powered by the right emergency AC bus. If normal power is disrupted, the control logic is designed to switch first to the left emergency DC bus, and then if necessary, to the battery packs.
The batteries are on continuous charge whenever the EMER LT switch located in the cockpit is in the ARMED position and the EMER LT switch located at the left mid-cabin attendant station is in the OFF position. This is the normal in-flight switch configuration. Fully charged batteries will allow for about 15 minutes of emergency lighting.
The emergency lights can be turned on by using either the EMER LT switch in the cockpit, or the switch at the attendant station. The lights turn on automatically with a loss of power to the 115 V AC ground service bus.
The first item in the Swissair Smoke/Fumes of Unknown Origin Checklist (see Appendix C) calls for selecting the CABIN BUS switch to the OFF position. Doing so removes the electrical power from the cabin bus that supplies power to most of the cabin electrical services. If the EMER LT switch on the cockpit overhead panel is not switched to the ON position before moving the CABIN BUS switch to OFF, the cabin emergency lights will not automatically illuminate. In such a case, either the pilots or a cabin attendant would need to turn the EMER LT switch on to activate the emergency lights.
220.127.116.11 Flight crew reading light (Map light)
The MD-11 cockpit has four map lights installed in the overhead ceiling area (see Figure 16). These lights provide additional illumination for the pilot and first officer positions, and for the left and right observers' stations. On the occurrence aircraft, the captain, first officer and right observer's station lights (PN 2LA005916-00) were manufactured by Hella KG Hueck & Co. (Hella). The left observer's light, PN 10-0113-3, was manufactured by Grimes Aerospace Co., and was a different design than the Hella light.
The Hella map light is designed to pivot up to 35 degrees from its vertical axis through 360 degrees. The light intensity is adjusted by turning the smaller diameter ring on the light head, which also serves as an ON/OFF switch. The size of the light beam, or area of illumination, is adjusted by turning the larger diameter ring on the light head. The map light was equipped with a 11.5 watt (W), 28 V DC tungsten halogen lamp.
The front of the map light is covered by a plastic ball cup; an insulating protective cap is installed on the rear of the light fixture. The protective cap is designed to insulate and protect the metal contact spring, which serves as the positive terminal that applies 28 V DC electrical power to the lamp base.
The Swissair MD-11 flight crew bunk module lights, PN 2LA 005 916-00 SWRA, were also manufactured by Hella. This bunk light was a map light that had been modified by removing the functionality of the ON/OFF switch to meet an FAA certification requirement. Although the bunk light used a different outer housing than the map light, the internal components were identical.
1.6.19 Emergency equipment
18.104.22.168 Cockpit emergency equipment
The Swissair configuration of the MD-11 cockpit has four seats, with an oxygen mask dedicated to each seat position (see Figure 17). A rechargeable flashlight for each pilot is readily available from the seated position. Additional emergency equipment is stored on the cockpit rear wall behind the captain's seat; to retrieve this equipment, pilots have to leave their seats. The additional equipment includes a Halon 1211 fire extinguisher, fire gloves, two sets of portable protective breathing equipment (PBE), two additional flashlights, a crash axe, four life vests, and an emergency VHF radio transceiver. The emergency transceiver, which is normally stowed in the OFF position, is self-contained, battery operated, and pre-set to the international emergency frequency 121.5 MHz.
22.214.171.124 Cabin emergency equipment
The following emergency equipment is located in the cabin: seven fire extinguishers (five Halon 1211 and two dry chemical extinguishers) and fire glove sets, eight 310 litre (L) and two 120 L portable first-aid oxygen bottles with masks, one crash axe, 14 flashlights, 11 sets of PBE, life vests for each passenger and flight attendant, medical kits, a megaphone, along with other miscellaneous items. In the skybunk flight crew rest areas there are two additional 120 L first-aid oxygen bottles, and two flashlights. In the cabin crew rest area there are an additional four 310 L oxygen bottles, one PBE, one Halon 1211 extinguisher, gloves, and a flashlight. (See also Section 126.96.36.199.)
188.8.131.52 Flight Crew Oxygen
The Swissair MD-11 flight crew oxygen is supplied from one aluminum, high-pressure oxygen cylinder wrapped with a para-aramid fibre. The system delivers regulated oxygen through stainless steel lines to mask-mounted regulators, and supplies the captain, first officer, and the two observers' positions. A "T" fitting is installed in the stainless steel supply line near the crown of the aircraft, between STA 383 and STA 374, to provide an option for an additional crew mask in the freighter configuration. The "T" fitting is capped with an AN929-6 aluminum cap that, when installed, protrudes through the between-frame insulation blankets into the cockpit attic area (see Figure 5).
Each full-face mask assembly is stowed in a quick-access stowage box at each flight crew station, with the oxygen supply lines and microphone connections at the base of each stowage box (see Figure 11). When the oxygen mask stowage box door is opened, the mask microphone is automatically activated and the boom microphone deactivated.
The crew oxygen masks have a six-foot attachment line. Therefore, with the mask on, the captain can reach all of the emergency equipment, the cockpit door, and the overhead CB panels. The first officer would not be able to reach any of the emergency equipment, but can reach the cockpit door and the overhead CB panels. If conditions permitted, an option for the first officer would be to don an observer's oxygen mask; the hose length of either of these two oxygen masks would allow sufficient range of movement to reach the PBE and flashlights. The two portable PBEs each have a 15-minute supply of oxygen.
Each flight crew oxygen mask is fitted with a pneumatic harness, which is inflated by pressurized oxygen by manually actuating a lever on the regulator. When inflated, the harness allows easy donning and doffing of the mask, and fits easily over glasses and headsets. The harness deflates on release of the lever, tightening the mask to the wearer's face. The mask is equipped with a vent valve to purge any smoke from the goggles.
The mask-mounted regulators can function in one of three positions: normal diluter demand, 100 per cent oxygen, or emergency pressure breathing. The default position is normal diluter demand; 100 per cent oxygen or emergency pressure must be selected by the pilots. Such a selection would be made as warranted by the circumstances.
The SR 111 pilots were using oxygen for about 15 minutes. The charge state of the bottle at take-off was not determined; however, with both pilots using 100 per cent oxygen, the duration of the supply with a minimum dispatch pressure of 1 000 pounds per square inch (psi) would be at least 64 minutes. At 1 850 psi, which is a fully charged bottle, the duration would be about 119 minutes.
The crew oxygen cylinder pressure was last checked and the cylinder was refilled, on 9 August 1998, during an "A check." The cylinder was last hydrostatically tested on 17 March 1997. An examination of the crew oxygen cylinder showed that it was pressurized at the time of impact. During the time the CVR was recording, the pilots did not indicate having any problems with the oxygen system.
184.108.40.206 Passenger oxygen
The MD-11 is fitted with independently mounted oxygen generators throughout the passenger and cabin crew areas. These generators supply oxygen masks that drop from compartments in the overhead panels. The masks are designed to be fitted over the nose and mouth. Once activated, each generator is capable of supplying a flow of oxygen to the masks that it serves for a minimum of 15 minutes.
The passenger cabin masks are stored behind module doors above the seats. The doors are held closed by electrically operated latches. The latches are powered by the 115 V AC buses 1, 2, and 3. If the cabin pressure decreases below a value equivalent to the standard pressure at 14 400 feet, the latches release and the doors fall open, allowing the masks to drop. The doors can also be selected open by the pilots through a switch in the cockpit.
The occurrence aircraft was equipped with 148 oxygen generators.
The Swissair MD-11 Aircraft Operations Manual (AOM) warns that passenger oxygen masks must not be released below a cabin altitude of 14 000 feet when smoke or an abnormal heat source is present, as the oxygen may increase the possibility or severity of a cabin fire. As is typical with passenger oxygen masks in general use in transport category aircraft, the passenger masks in the MD-11 were designed to provide a mix of oxygen and ambient air. Therefore, the use of the masks would not have prevented passengers from inhaling smoke if it were present.
The occurrence MD-11 aircraft was equipped with three Pratt & Whitney model 4462 engines. The engines are referred to by number: Engine 1 mounted under the left wing, Engine 2 mounted in the vertical stabilizer (tail), and Engine 3 under the right wing.
The aircraft is also equipped with an APU mounted in the tail section. The APU on the occurrence aircraft was not used by the pilots before the stoppage of the FDR, and it was not operating at the time of impact.
220.127.116.11 Full-authority digital electronic controls
The engine thrust for each engine is controlled by a dual-channel (channels A and B) FADEC that interfaces with the aircraft and engine control systems. Each channel is independently capable of controlling engine operation. Electrical power to each FADEC is supplied primarily by an engine-driven permanent magnet alternator. Each FADEC can also be powered, if necessary, by the aircraft electrical system, through a supplemental control unit (SCU); this was an optional feature installed on this aircraft. This method of powering the FADEC using the SCU is referred to as back-up power. The FADEC also receives inputs from the engine throttle resolvers located below the central pedestal and linked to the throttle levers. There are two throttle resolvers per throttle lever. One resolver provides throttle resolver angle (TRA) input to Channel A and the second to Channel B. Electrical excitation for the resolvers is provided by the FADEC.
Each FADEC channel (A and B) also receives information from three digital data buses. Two of the buses supply data from the ADCs and the other supplies data from the FCCs. FCC-1 provides data to Channel A and FCC-2 provides data to Channel B. The ADCs provide pressure altitude, fan inlet total pressure (Pt2)Footnote 42 and total air temperature (Tt2)Footnote 43 to channels A and B. The FCCs provide EPR trim, engine bleeds, Weight-On-Wheel (nose gear compressed), and "flaps/slats retracted" information.
Each FADEC channel includes non-volatile memory (NVM) that records fault information used for maintenance scheduling and troubleshooting. There are 192 continuously available NVM fault cells. Each fault is registered only one time per flight leg, but is rewritten to memory when the engine is shut down with the engine FUEL switch. The contents of the fault memory will typically span many flights. The information in these memory cells is retained until all 192 NVM cells have been filled with information, at which time the information begins to be overwritten from the beginning.
Certain faults will cause the engine to revert from the normal EPR mode to the soft reversionary N1 mode of operation. This reversion will also cause the autothrottles to disconnect. Autothrottle cannot be re-engaged if any engine is in the N1 mode. Loss of TRA input will cause the engine to go to a fixed thrust that cannot be altered through the throttle control levers.
1.6.21 Landing performance
Landing distances at various aircraft weights were calculated to determine whether the occurrence aircraft could have stopped safely on Runway 06 at the Halifax International Airport. Calculations were completed for the occurrence aircraft with all systems operating normally, and with certain technical malfunctions.
The horizontal distance necessary to land an aircraft and come to a stop on a level, smooth, dry, hard-surfaced runway is called the landing distance. This distance is based on the aircraft being in the landing configuration on a stabilized landing approach at a height of 50 feet (15 m) above the landing surface (usually the runway threshold). For normal operations at destination and alternate airports, regulations require that this full stop landing be accomplished within 60 per cent of the available runway length,Footnote 44 with spoilers, and anti-skid operative, but without use of thrust reversers.
The Swissair MD-11 AOM contains landing graphs that flight crew can use to calculate anticipated landing distances. These graphs provide landing information for 35-degree and 50-degree flap settings, predicated on aircraft landing weight, airport elevation, wind component, and runway surface conditions. For unscheduled landings, the regulations do not require any operational reserve or safety margin as would be included when calculating the runway length for normal operations (1.67 multiplied by the landing distance).
The atmospheric conditions that existed at the time of the occurrence for a landing on Runway 06 at the Halifax International Airport were taken into account. For situations where all aircraft systems are operating normally, the calculated landing distances for various weights are shown in Table 10.
|Aircraft Weight||Flaps 35 Degrees Landing||Flaps 50 Degrees Landing|
|199 580 kg||4 725 ft.||4 236 ft.|
|218 400 kg||5 118 ft.||4 725 ft.|
|230 000 kg||5 316 ft.||4 920 ft.|
If certain technical malfunctions occur, additional horizontal stopping distance will be used by the aircraft; therefore, a correction factor would need to be applied to estimate these increased landing distances. The Swissair AOM lists correction factors that must be added to the landing distance for various possible malfunctions. As indicated in Section 18.104.22.168, the wreckage revealed that the slats were retracted; if the pilots were aware of this anomaly, they would be required to land the aircraft with 28 degrees of flap, which is the certified landing configuration with slats retracted. Also, fire damage to the upper avionics CB panel resulted in several systems failures being recorded before the flight recorders stopped. The ground sensing CB is located in the area adjacent to the systems that were recorded as faults. If the ground sensing circuit was compromised because of the fire, the aircraft, once on the runway, would not have auto ground spoilers or the brake anti-skid feature. These additional factors would need to be added to the calculated landing distance. The minimum landing distance the SR 111 aircraft would have required under conditions of no slats, inoperative spoilers, and anti-skid brakes is shown in Table 11.
If the flight crew were unable to select 28 degrees of flap and landed with 15 degrees of flap, the landing distances would increase by approximately 12 per cent, as shown in Table 11. If the flight crew were able to get the flaps to 50 degrees and decided to conduct a landing in this unconventional configuration, then the above landing distances would be reduced by approximately 10 per cent.
|Aircraft weight||Flaps 15 Degrees,
Auto Ground Spoilers
|Flaps 28 Degrees,
Auto Ground Spoilers
|Flaps 50 Degrees,
Auto Ground Spoilers
|199 580 kg||10 700 ft.||9 600 ft.||8 700 ft.|
|218 400 kg||11 800 ft.||10 600 ft.||9 500 ft.|
|230 000 kg||12 400 ft.||11 100 ft.||10 000 ft.|
A caution in the AOM landing graphs states that for every 5 knots above the ideal approach speed, the landing distance will increase by 1 000 feet. The SR 111 flight crew was dealing with smoke and fire in the cockpit and failed aircraft systems and displays, and at some point was flying on standby instruments. Therefore, it is likely that the aircraft would not have been at the ideal position and speed for landing over the threshold, which could further increase the landing stopping distance. Thrust reversers, if available, would reduce this distance slightly.
Considering all of the factors, the SR 111 landing would likely have required more runway than the 8 800 feet available on Runway 06 at the Halifax International Airport.
1.6.22 Aircraft maintenance records and inspection
The Maintenance System Approval Statement contained in Swissair's Air Operator Certificate (AOC) 1017 stated that Swissair was approved under Joint Aviation Requirements (JAR)-OPS 1, Subpart M, to manage the maintenance of its MD-11 aircraft. At the time of the occurrence, Swissair had contracted all aircraft maintenance to SR Technics, and Swissair had no in-house maintenance capability. As a JAR/FAR 145-approved repair station, SR Technics was contracted to perform all aircraft maintenance defect rectification, maintenance checks beyond the pre-flight, maintenance engineering activities, maintenance planning, and spare parts handling in support of Swissair's operations.
22.214.171.124 Maintenance records
During the investigation, a review was conducted of Swissair/SR Technics' maintenance program, record-keeping procedures, and the occurrence aircraft's maintenance records. A small number of discrepancies were discovered regarding engineering orders (EO) and logbook entries. The discrepancies were considered minor, and the overall method of record-keeping was considered to be sound. The maintenance records kept for HB-IWF indicate that it was maintained in a manner commensurate with industry practices.
The review of the aircraft's maintenance records, which included the technical logbook entries from 10 September 1997 until 2 September 1998, the last three "A checks," and the IFEN System Maintenance Activity Review, did not identify any events that were considered relevant to the investigation.
126.96.36.199 Maintenance inspections
In addition to the maintenance checks carried out before every departure, Swissair MD-11s underwent a series of scheduled maintenance activities. These were accomplished at various flight hours (FH) as follows: "A check" every 700 FH; "C check" every 6 000 FH; and first "D check" at 30 000 FH or 72 months, whichever occurred first. The last scheduled maintenance activity carried out on the occurrence aircraft was an "A check" completed on 10 August 1998.
A review of HB-IWF's maintenance history verified that all requirements of the approved maintenance program were completed either on time, or within the tolerance granted to Swissair by the Swiss Federal Office for Civil Aviation (FOCA).
188.8.131.52 MD-11 Service information
184.108.40.206.1 Service bulletins
Aircraft manufacturers and product vendors issue to users of their products, documents that are designed to improve the level of flight safety, to provide specific advice or instructions, or both. These documents include, but are not limited to, Service Bulletins (SB), Alert Service Bulletins (ASB), Service Letters, and All Operator Letters (AOL). The type of document issued depends upon the issuer's assessment of the urgency or severity of the information being presented; ASBs have the highest priority. Compliance with these documents is at the owner's or operator's discretion, as compliance is not mandatory unless an associated Airworthiness Directive (AD) is promulgated by the applicable regulatory authority.
At the time of the occurrence, there were 822 MD-11 SBs applicable by fuselage number to HB-IWF of which 51 were ASBs. Of the 51 ASBs, 47 were complied with, 2 were related to AD 94-10-03 for which an exemption was granted (see Section 220.127.116.11.2), 1 was underway, and 1 was specific to a water heater installation that was not installed in the Swissair fleet of MD-11s. The SR Technics engineering department reviewed each SB. If it determined that the SB warranted incorporation, they produced an EO. The determination to accept or reject an applicable SB was made by the cognizant engineer, and reviewed and approved by the cognizant engineer's manager.
A review of the aircraft manufacturer's MD-11 SBs issued up to the time of the accident identified 16 that were considered of interest to the investigation. Included in these were SBs related to events that could cause chafing, arcing, sparking, or smoke in the cabin or cockpit.
18.104.22.168.2 Airworthiness directives
An AD, typically based on either a manufacturer's or vendor's SB, is issued when an unsafe condition exists and that condition is likely to exist or develop in other products of the same type design. An AD is a regulatory directive mandating an inspection, repair, modification, or procedure issued either by the state of manufacture or by the CAA of the country in which the aircraft is registered.
The FOCA adopts and reissues each AD published by a state of manufacture pertaining to aircraft registered in Switzerland or with products that might be installed on Swiss-registered aircraft. Within SR Technics, the FOCA AD will only be distributed if it is not covered by an AD issued by the state of manufacture, or if there are deviations in the content. Swissair complied with all ADs issued by the state of manufacture, even if they were not legally binding for Swiss-registered aircraft under Swiss legislation.
At the time of the occurrence, 57 MD-11 ADs were issued by the FAA that were applicable to the occurrence aircraft. The SR Technics "Status List of Engineering Orders" verified that all applicable ADs had been accomplished, with the exception of AD 94-10-03, for which an exemption has been granted to Swissair by the FOCA. AD 94-10-03 addressed a potential software anomaly involving navigation equipment input to the FMC/FCC, and was therefore not deemed to be relevant to the circumstances of this occurrence. A review of the MD-11 ADs issued by the FAA up to the time of the accident identified the following two ADs that were potentially related to either the area of the fire damage in SR 111 (AD 93-04-01) or other smoke events in the cockpit (AD 97-10-12).
The subject of AD 93-04-01 was to "prevent display units from going blank, which could lead to momentary loss of flight critical display information." This AD took effect on 2 April 1993 and referred to ASB MD-11 A24-51, which took effect on 11 September 1992. SR Technics accomplished the AD on 14 January 1993 when the ASB was completed.
The subject of AD 97-10-12 was to "detect and correct chafing of the wire bundles adjacent to the avionics disconnect panel bracket assembly and consequent in-flight arcing behind the avionics CB panel, which could result in a fire in the wire bundles and smoke in the cockpit." This AD took effect on 16 June 1997 and referred to SB MD11-24-111, which took effect on 3 December 1996. SR Technics had accomplished this AD on HB-IWF on 6 March 1997.
22.214.171.124 MD-11 Service difficulty reports
A search of the FAA's Service Difficulty Report (SDR) database for MD-11/11F entries, submitted until September 1998, revealed a total of 970 SDRs.Footnote 46 At that time, the MD-11/11F SDRs were reviewed using the keywords fire, smoke, and smell. Additionally, the same data was searched using the Air Transport Association (ATA) codes for communications (2300) system, power distribution (2400), and fire protection (2600) systems. This review revealed some general statistical information referred to in Section 1.18.10, but did not identify specific discrepancies relevant to the circumstances of this investigation. Detailed and specific information regarding wiring discrepancies was not consistently available as it was not required to be captured within the SDR database. There was no dedicated Joint Aircraft Systems/Components Inspection Code (enhanced ATA codes) used to collect, compile, and monitor data regarding wiring discrepancies. However, during the course of this investigation, on the basis of wiring data issues highlighted by National Transportation Safety Board (NTSB) investigations such as Trans World Airlines 800Footnote 47 and by industry group deliberations, the FAA requested that the ATA introduce a new ATA reporting code subchapter (97) to facilitate more accurate tracking of specific wire-related problems and anomalies.
126.96.36.199 MD-11 Maintenance management
As with any commercial aircraft, the maintenance management of the MD-11 involved various companies and regulatory agencies. Beyond Swissair's maintenance obligations, as outlined in their AOC, SR Technics, the FOCA, the FAA, and Boeing all had either direct or indirect maintenance management commitments in support of Swissair's MD-11 fleet (see Section 1.17).
1.7 Meteorological information
Two active weather systems were in the area of the SR 111 flight track between New York to Halifax: a line of thunderstorms moving through the New York area; and Hurricane Danielle, which was located approximately 300 nm southeast of Halifax. The forecasted effects of both systems were moving in a predictable manner. Nova Scotia was under the influence of a weak ridge of high pressure and the distant effects of the hurricane.
1.7.2 Forecast weather
The aviation area forecast weather for the region including Peggy's Cove was as follows: 2 000 to 3 000 feet scattered, occasional broken cloud with the tops at 8 000 feet; 10 000 feet broken occasional overcast with the tops at 16 000 feet, high broken cloud, visibility greater than 6 statute miles (sm).
The terminal aerodrome forecast (TAF) for Halifax Shearwater Airport, located between the Halifax International Airport and the crash site near Peggy's Cove, was as follows: surface wind 070 degrees True at 10 gusting to 20 knots; visibility greater than 6 sm; a few clouds at 500 feet agl; scattered clouds at 2 000 feet agl, broken clouds at 24 000 feet agl; temporarily from 2300 to 0200, 5 sm in light rain showers and mist; scattered clouds at 500 feet agl, broken clouds at 2 000 feet agl, and overcast at 10 000 feet agl.
The TAF for Halifax International Airport was as follows: surface wind 090 degrees True at 10 knots; visibility greater than 6 sm; scattered cloud layers at 3 000 feet agl, broken cloud at 8 000 feet agl, and broken cloud at 25 000 feet agl.
1.7.3 Actual reported weather
The actual weather at JFK airport just prior to the departure of SR 111, was as follows: surface winds 170 degrees True at 12 knots; visibility 10 sm in thunderstorms and light rain; broken cloud at 2 200 feet agl, broken cloud at 4 000 feet agl consisting of cumulonimbus clouds, overcast layer at 9 000 feet agl; temperature 23°C; dew point 21°C; altimeter setting 29.73 inches of mercury (in. Hg). Remarks: thunderstorms in vicinity, west to northwest of the airport, moving eastward; thunderstorm began at 0010, rain began at 0003.
The weather at the Halifax Shearwater Airport at 0100 was as follows: surface winds 060 degrees True at 9 knots; visibility 15 sm; few clouds at 1 200 feet agl, broken clouds at 7 000 feet agl, overcast at 25 000 feet agl; temperature 18°C; dew point 15°C; altimeter setting 29.78 in. Hg; and cloud cover: stratus fractus 1/8, altocumulus 5/8, cirrus 3/8.
The weather at Halifax International Airport at 0100 was as follows: surface winds 100 degrees True at 10 knots; visibility 15 sm; broken cloud at 13 000 feet agl, overcast at 24 000 feet agl; temperature 17°C; dew point 13°C; and altimeter setting 29.80 in. Hg; and cloud cover: altocumulus 6/8, cirrostratus 2/8.
Between 0100 and 0200, the sky in the Peggy's Cove area was partially covered by clouds, and there were rain showers in the area. Visibility was recorded as "good" at weather stations on land; however, it was somewhat reduced in mist over the sea. The winds were blowing at about 10 knots. The air temperature was about 16°C.
1.7.4 Upper level wind
The wind at FL330 was from 210 degrees True at 65 knots, providing a ground speed for SR 111 of about 530 knots or nearly 9 nm per minute. The tailwind decreased during the descent, and diminished to about 13 knots from 200 degrees True at 10 000 feet.
1.7.5 Weather briefing
Swissair flight operations officers in New York briefed the pilots and the flight planning was routine, the only exception being the selection of a more northerly track than normal. This route was chosen to avoid any adverse weather being generated by Hurricane Danielle. The weather briefing package received by the crew included, in part, forecasts for Boston, Bangor, and Halifax.
1.7.6 Weather conditions on departure from JFK
At the time SR 111 departed from JFK airport, there was lightning associated with cumulonimbus clouds in the area, northwest and south of the airport. Within two minutes after take-off, the flight crew requested a heading deviation from the cleared track routing to avoid the isolated thunderstorms in that area. Cloud-to-ground lightning strike data indicated that the aircraft was more than 23 nm away from the closest ground strike and much farther away from the major ground lightning activity. Therefore, it is unlikely that the aircraft sustained a direct lightning strike from the cloud-to-ground lightning.
The weather report at JFK airport included occasional lightning in cloud at the time of SR 111's departure, with isolated thunderstorms and cumulonimbus clouds in the vicinity. There was no reported lightning from cloud-to-cloud, only within the cloud. The thunderstorms were miles apart; therefore, it is unlikely that the aircraft intercepted a cloud-to-cloud lightning strike.
The FDR showed no anomalies that might have indicated any unusual electrical disturbance within the aircraft during this period of time, and there was no recorded ATS communication to indicate that any lightning strike phenomena affected the aircraft. The available information indicates that the aircraft was not struck by lightning.
1.7.7 Weather conditions during descent
SR 111 would have encountered several layers of cloud during its descent, placing the aircraft in instrument meteorological conditions. The first layer of cloud was broken to overcast based at 24 000 to 25 000 feet. The aircraft would have likely entered a second layer of cloud at around 16 000 feet. The base of this layer was approximately 12 000 feet over the Halifax International Airport, sloping down to 7 000 feet over the Halifax Shearwater Airport.
As SR 111 proceeded north of the Peggy's Cove area at 10 000 feet, it is likely the aircraft was near the base of a cloud layer and may have temporarily been clear of cloud with good night flight visibility. As SR 111 headed south toward the ocean and began descending, it is likely that it would have entered a second layer of cloud. It would have entered a third layer at approximately 5 000 feet, and exited the layer no lower than 1 500 feet. Below 1 500 feet, the flight visibility was reported to be good and was likely unobstructed by cloud with the possibility of some light precipitation and fog over the water. When SR 111 was tracking toward the ocean, it would likely have been dark over the sea because of the cloud cover, mist, and lack of surface lights.
1.8 Aids to navigation
All ground-based navigation aids in the Halifax area were recorded as serviceable at the time of the occurrence.
This section provides information on aeronautical mobile and fixed service air-to-ground and ground-to-air communications, and their effectiveness at the time of the occurrence.
All recorded communications between SR 111 and the various air traffic control (ATC) units involved with the flight were of good technical quality; that is, all of the recording equipment functioned normally and the sound quality was up to the normal standard. All ground-based radio communications facilities related to the SR 111 flight were serviceable. Boston Air Route Traffic Control Center (ARTCC) experienced a 13-minute communications gap with SR 111, starting at 0033 and ending at about 0046. Information concerning the 13-minute communications gap is provided in sections 188.8.131.52.2 and 2.11 of this report. Other than this anomaly, no communications interruptions or discrepancies were reported by ATS or by any other aircraft along the route flown by SR 111 during the time of the flight.
1.9.2 Controller training
Nav Canada provides annual refresher training for controllers on relevant topics using basic lesson plans based on information in the Air Traffic Control Manual of Operations (ATC MANOPS) and other sources. The ATC MANOPS information on emergency procedures emphasizes air traffic separation responsibilities and administrative duties of controllers. In their aircraft emergencies training, controllers are expected to use their best judgment in handling situations not specifically covered, because it is impossible to detail procedures for all emergency situations. Information provided reminds controllers that "when an emergency occurs, time is of the essence, so all questions must be clear and concise. In order to respond effectively, the controller must rely on the information that the pilot provides." Throughout the occurrence, the controller took his lead from the pilot, believing that the pilot was the one who could best determine the nature of the situation in the aircraft, the nature of his requirements, and what he wanted the controller to do. Prior to this occurrence, controllers were provided basic training on how to respond to aircraft emergencies, but did not receive basic or continuation training on the flight and general operating requirements of aircraft in abnormal or emergency situations. In particular, controllers did not receive training on aircraft general operating procedures for fuel dumping and on basic indications they could expect from the aircraft.
1.9.3 Transition procedures and controller communications
The usual transition procedure for an aircraft in high-level airspace inbound to Halifax is to transition from a high-level en route air traffic controller to a low-level airspace controller, and then to a third controller responsible for traffic within the Halifax terminal control area. The airspace is controlled by the Moncton ACC, located in Riverview, New Brunswick. In this instance, the high-level en route controller coordinated with both the low-level controller and the Halifax terminal controller to reduce the number of RF changes required and to help expedite the descent. At 0118:16, the high-level en route controller instructed SR 111 to contact the Halifax terminal controller on frequency 119.2 MHz. Moncton ACC allocated one controller, with exclusive use of frequency 119.2 MHz, to meet the communications needs of SR 111 on approach to Halifax.
A detailed comparison was made between the transcript of the ATC transmissions and the recommended phraseology in the Nav Canada ATC MANOPS. Although there were occasional instances of minor omissions or substitutions, there was no indication that any of the advisories, clearances, or requests made by ATC were misunderstood or missed by the crew of SR 111. Similarly, the transmissions by the pilots of SR 111 were consistent with accepted industry standards and practices.
1.9.4 Emergency communications
When pilots transmit a message to indicate an abnormal situation or condition, the degree of danger or hazard determines the terminology to be used. A situation in which the safety of the aircraft or of a person on board is threatened, but that does not require immediate assistance, is a condition of urgency. The internationally recognized spoken expression for urgency is "Pan Pan," which is spoken three times in succession. A situation in which the safety of the aircraft or a person on board is threatened by grave and imminent danger, and that requires immediate assistance is a condition of distress. The internationally recognized spoken expression for distress is "Mayday," which is also spoken three times in succession. If the pilots already have the ATS controller's attention, it has become common practice for them to declare an "emergency," instead of using the term "Mayday." This practice is accepted within the aviation industry.
Nav Canada requires controllers to comply with the directives about emergency communication contained in the ATC MANOPS, Part 6, "Emergencies." Subpart 601 instructs controllers to provide assistance to the aircraft in distress, to use all available facilities and services, and to coordinate with concerned agencies. As well, the ATC MANOPS advises that controllers should keep flight crews accurately informed and exercise their best judgment in difficult situations.
The pilots of SR 111 and the controllers communicated in normal tones in all of their communications prior to the pilots declaration of an "emergency" situation. When the pilots declared an emergency at 0124:42, there was a slight elevation in their voices that reflected a higher sense of urgency. From the time of the Pan Pan call at 0114:15, the controllers at Moncton ACC treated the situation as they would treat an emergency; that is, they responded in the same way they would have had pilots made a Mayday call. Moncton ACC responded to the diversion situation, and their actions were in accordance with their standard practice.
1.9.5 Air traffic services communication regarding fuel dumping
Fuel dumping information for Nav Canada air traffic controllers is contained in Part 7 of the ATC MANOPS. Section 701, "Fuel Dumping," instructs controllers to obtain information about the track, the time frame for dumping, and the in-flight weather conditions. As well, controllers are advised to encourage an aircraft to dump fuel on a constant heading over unpopulated areas and clear of heavy traffic. Controllers are also advised to restrict the altitude to a minimum of 2 000 feet above the highest obstacle within 5 nm of the track, and arrange for a warning to be broadcast frequently on ATC frequencies during the period of the fuel dump.
Additional fuel dump information for controllers in the Moncton ACC is contained in the Moncton ACC Operations Manual, 07-98. Section 3.20 identifies the preferred fuel dumping area for the Halifax area and instructs controllers to advise the appropriate flight service station (FSS) or stations.
After verifying with the pilots that a turn to the south was operationally acceptable to the crew, the controller chose a planned location for the SR 111 fuel dump, which was over St. Margaret's Bay, at an altitude above 3 000 feet. This location complied with ATS guidelines and would position the aircraft for a turn onto the on-course for the back-course approach to Runway 06.
When SR 111 advised the controller of the requirement to fly manually without further elaboration, the controller assumed that manual flight was a Swissair procedure to be followed during fuel dumping. When the pilots did not acknowledge the controller's clearance to commence fuel dumping, and when immediately thereafter the aircraft's Mode C transponder stopped providing data to the ATS radar, the controller interpreted this cessation of information from SR 111 to be the result of an electrical load-shedding procedure that Swissair used during fuel dumping operations. This interpretation was based on the controller's experience with military aircraft refuelling exercises carried out over Nova Scotia during which military fighter aircraft receiving fuel typically turned off unnecessary electronics, including the transponder.
1.10 Aerodrome information
Halifax International Airport is 14 nm north-northeast of Halifax, at an airport elevation of 477 feet. ATC services for the Halifax airport are provided by radar controllers in the Moncton ACC and airport controllers in the Halifax ATC tower. The airport has runways oriented in two directions: Runway 15/33, which is 7 700 feet long; and Runway 06/24, which is 8 800 feet long. The runways are 200 feet wide and have an asphalt surface. The landing distance available for all the runways is equivalent to their full length.
Runways 24 and 15 are each served by an ILS approach; and runways 06 and 33 are each served by a localizer back-course approach. Runways 06 and 24 are also each served by an NDB approach. The NDB for Runway 06 is the Golf beacon, which is located on the extended centreline, 4.9 nm from the threshold of Runway 06.
Aircraft Firefighting Services at the Halifax International Airport met the availability and equipment requirements of the CARs. The Aircraft Firefighting Services were activated at 0120 and, within one minute, the response vehicles were in place adjacent to the runway of intended landing.
1.11 Flight recorders
This section describes the performance of the flight recorders on SR 111, and the general value of recording devices to safety investigations.
The occurrence aircraft was equipped with a digital FDR and a CVR. The FDR was an L3 Communications (Loral/Fairchild) model F-1000, which records about 250 parameters in solid state memory. The recorder contained about 70 hours of continuous flight data, which included the accident flight, and the six previous flights. The FDR, as configured, did not record the parameters "Lavatory Smoke" and "Cabin (Cargo) Smoke." Nor did the FDR record any parameters related to the IFEN system. The data recorded on the FDR was of good technical quality.
The CVR was an L3 Communications (Loral/Fairchild) model 93-A100-81. The recording medium was 1/4-inch tape on a continuous loop. The design provided for a nominal recording time of 30 minutes. The actual length of the CVR recording was 32 minutes, 24 seconds, starting at 0053:17 and stopping at 0125:41. The CVR recorded on four separate tracks: the output of each of the two pilot's audio management units (AMU); the cabin interphone or public address audio, whichever is selected; and the cockpit area microphone (CAM).
The CVR-recorded audio was of fair technical quality overall. Prior to when the pilots donned their oxygen masks, which incorporate a "hot" microphoneFootnote 48 input to the pilot and co-pilot channels of the CVR, cockpit conversations were recorded only on the CAM channel. While in cruise flight, the pilots were not using their headsets, which incorporate integral boom microphones that provide better quality CVR recording than does the CAM. The industry norm is to not use the headsets while cruising at high altitude, and there was no regulation or company policy requiring them to do so. Despite extensive filtering attempts, some of the audio information recorded by the CAM on the CVR was difficult or impossible to decipher because of masking, either by the ambient cockpit noise, or by background ATS radio communications emanating from the cockpit speaker. The pilots' internal verbal communication was mostly in the Swiss-German language.
1.11.2 Recorder installation power requirements
The CVR was powered by the 115 V right emergency AC bus and the FDR was powered by the 115 V AC Bus 3. Both buses are part of the 115 V AC Generator Bus 3 distribution system.
FAR 25.1457 (CVR), FAR 25.1459 (FDR), and the equivalent JARs, require that recorders be installed so that they receive power from the electrical bus that provides the maximum reliability for operation without jeopardizing service to essential services or emergency loads. Transport Canada's Canadian Aviation Regulations Standards Part V–Airworthiness Manual, Chapter 551, Articles 551.100 and 551.101 state that the FDRs and the CVRs shall be installed in accordance with the European Organisation for Civil Aviation Equipment (EUROCAE) documents ED-55 and ED-56A respectively. Additionally, the EUROCAEFootnote 49 references suggest that the FDR and the CVR be powered by separate sources.
Initially on the DC-10, the FDR was electrically powered by the 115 V AC Bus 3, and the CVR from 115 V AC Bus 1. However, for JAA certification, the CVR had to be powered by the 115 V right emergency AC bus, which is in turn powered by Generator Bus 3. As a result, both recorders were powered by the same source: Generator Bus 3. The MD-11 emergency checklist dealing with smoke/fumes of unknown origin requires the use of the SMOKE ELEC/AIR selector. This selector is used to cut power to each of the three electrical buses, in turn, to isolate the source of the smoke/fumes. The nature of this troubleshooting procedure requires that the selector remain in each position for an indeterminate amount of time, typically at least a few minutes. When the SMOKE ELEC/AIR selector is placed in the first (3/1 OFF) position, AC Generator Bus 3 is turned off, thereby simultaneously disabling the FDR and the CVR. With both the CVR and the FDR on the same generator bus, a failure of that bus, or the intentional disabling of the bus (e.g., as a result of checklist actions in a smoke situation), will result in both recorders losing power simultaneously.
1.11.3 Stoppage of recorders
Examination of various recovered aircraft system components show that the 115 V AC Generator Bus 3 was powered at the time of impact. On the base portion of the SMOKE ELEC/AIR selector that was recovered, there were indications that the selector was in the NORMAL position at the time of impact.
The CVR and the FDR both stopped because of the loss of electrical power during a 1-second time frame starting at 0125:41, which occurred 5 minutes, 37 seconds, before the aircraft struck the water. Two possibilities were examined to determine why the recorders stopped. The first was that the pilots selected the SMOKE ELEC/AIR selector to the 3/1 OFF position. The second was that a fire-related failure or failures led to the loss of electrical power to both recorders.
Selecting the SMOKE ELEC/AIR selector to the first position (3/1 OFF) would cause the two flight recorders to stop at exactly the same time, as the 115 V AC Generator Bus 3 is taken off-line.
The FDR data indicates that a brief power interruption to the digital flight data acquisition unit (DFDAU) occurred less than two seconds prior to FDR stoppage. This power interruption could not have been a result of selecting the SMOKE ELEC/AIR selector, as this would have resulted in an immediate shut down of the FDR and the CVR. A warm start re-initialization (reboot) of the DFDAU took place following the power interruption. The CVR also showed a discontinuity in recording within two seconds prior to CVR stoppage. These interruptions and discontinuities introduce variability in the relative timing between the two recordings and consequently in the precise relative stop times. It was possible to achieve a degree of time synchronization (less than one second between the CVR and the FDR). On the basis of time synchronization alone, it was not possible to determine whether the recorders stopped as a result of the SMOKE ELEC/AIR selector being selected to the 3/1 OFF position; other information was used to make this determination.
It is known that the pilots started the Smoke/Fumes of Unknown Origin Checklist by selecting the CABIN BUS switch to the OFF position. Prior to making that selection, the captain alerted the first officer about this action and received confirmation from him. The next action item in that checklist was the selection of the SMOKE ELEC/AIR selector. There are several indications that the flight recorders did not stop as a result of the use of the SMOKE ELEC/AIR selector. First, prior to the stoppage of the data recorders, the pilots made no mention of the SMOKE ELEC/AIR selector. Because the captain notified the first officer prior to selecting the CABIN BUS switch to the OFF position, the captain would likely have notified the first officer of his intention to move the SMOKE ELEC/AIR selector, as the first officer was the pilot flying and choosing the selector would have affected systems he was using. In addition, about 9 seconds after the flight recorders stopped, ATC began receiving Mode C (see Section 184.108.40.206) altitude data information from SR 111 for approximately 20 seconds. For this to have occurred, ADC-2, which is powered by the 115 V right emergency AC bus, had to be functioning. This bus would not have been powered if the SMOKE ELEC/AIR selector was in the first (3/1 OFF) position; therefore, it is very likely that this selector was in the NORM position when the recorders stopped recording.
1.11.4 Lack of CVR Information
The CVR in the occurrence aircraft had a 30-minute recording capacity; this met the existing regulatory requirements. The requirements were predicated upon the technology available in the early 1960s, and 30 minutes represented the amount of recording tape that could reasonably be crash protected. Current technology easily accommodates increased CVR recording capacity. The majority of newly manufactured, solid-state memory CVRs have a two-hour recording capacity; however, regulations pertaining to HB-IWF at the time of the accident did not require more than the 30-minute CVR recording capacity.
The earliest information on the SR 111 CVR was recorded approximately 17 minutes before the unusual smell was detected by the pilots. Conversations and cockpit sounds prior to the beginning of the CVR recording would have been useful in looking for potential initiating or precursor events that led to the in-flight fire.
Aircraft electrical power to the SR 111 flight recorders was interrupted at about 10 000 feet, which resulted in the FDR and the CVR recording stoppage. The aircraft continued to fly for about 5.5 minutes with no information being recorded.
Modern, maintenance-free, independent power sources and new-technology CVRs make it feasible to provide independent CVR and CAM power for at least several minutes. This would allow the continued recording of the acoustic environment of the cockpit, including cockpit conversations and ambient noises, in the event of the loss of aircraft power sources.
Current battery technology would not provide sufficient independent power to allow for the same option for FDR information. The multiple sensors and wiring that feed information to the DFDAU require aircraft power.
1.11.5 Quick access recorder
Initiatives undertaken by airlines, such as the development and implementation of increasingly complex flight operational quality assurance programs, require that an increased number of data sets be recorded. Quick access recorders (QAR) were developed because information in FDRs was not easily accessible for routine maintenance and monitoring of aircraft systems. This type of recording has been done on QARs, which are not required by regulation. Most QARs in use routinely record far more data parameters, at higher resolution and sampling rates, than do FDRs.
Unlike FDRs, QARs are not designed to survive in a crash environment. From the numerous pieces of magnetic tape recovered from the aircraft wreckage, 21 individual segments were identified as likely being from the aircraft's QAR. Attempts were made to extract information from the QAR tape; however, it was not possible to extract meaningful information from any of the pieces.
The QAR installed on SR 111 had a tape-based cartridge that recorded approximately 1 400 parameters, which is about six times the number of parameters recorded on the FDR. The additional data recorded on the QAR included numerous inputs that could have been valuable to the investigation. Such information could have assisted in determining the serviceability of aircraft systems prior to, during, and after the initial detection of the unusual smell and subsequent smoke in the cockpit.
Investigative agencies have traditionally promoted the view that additional parameters should be added to those already recorded on FDRs. Typically, the recording capacity of FDRs has not been the limiting factor; rather, these initiatives have been tempered by the high costs of installing the necessary equipment into the aircraft, including the additional data sensors and associated wiring. An additional limiting factor has been the high cost of obtaining certification for the changed mandatory FDR data set.
Modern FDRs, which employ the same solid state memory technologies as modern QARs, make it technically feasible to capture the QAR information within the FDR in a crash-protected environment. However, current regulations do not require that this be done.
1.11.6 Lack of image recording
The SR 111 cockpit was not equipped with an image recording device, nor was this type of device required by regulation.
Recently it has become economically realistic to record cockpit images in a crash-protected memory device. New "immersive" technology provides for economical single-camera systems that can capture a 360-degree panoramic view of the cockpit environment. Special playback software allows investigators to "immerse" themselves in the cockpit and virtually view the entire cockpit.
Such a capability could have been valuable during the SR 111 investigation; the investigation could have been expedited and potential safety action more easily identified.
1.12 Wreckage and impact information
This section describes the wreckage recovery process and methods, as well as the condition of the recovered pieces. In some instances, interpretations of the significance of the condition of recovered pieces are made.
1.12.1 Wreckage recovery
The search and rescue response to the event was immediate, and included resources from the Canadian Forces (CF) (Department of National Defence (DND)), Canadian Coast Guard (Department of Fisheries and Oceans), the Royal Canadian Mounted Police (RCMP) (Department of the Solicitor General of Canada), and numerous private individuals in boats from the local area. An exclusion zone was put in place to protect the site and to provide security during recovery operations. The exclusion zone was removed on 1 November 1999. Until that time, there was continuous security in place, and no known breaches of security occurred. Recovery and sorting of the wreckage took approximately 15 months to complete.
The wreckage site was located when the submarine HMCS Okanagan homed in on the underwater locator beacons (ULB) from the flight recorders. Various ship-borne underwater imaging technologies, divers, and video cameras on remotely operated vehicles (ROV), provided information about the wreckage condition and dispersion. The main debris field measured approximately 125 by 95 m (411 by 312 feet). The water depth was about 55 m (180 feet).
The focus of the initial recovery phase was on finding and recovering human remains, and on locating the CVR and the FDR. Extensive surveillance of the wreckage field and the surrounding area was completed to assess the various recovery options. Floating wreckage was scattered by wind and water currents, but no major piece of wreckage was found outside the confines of the irregularly shaped, single debris field on the seabed. Some of the wreckage recovery methods, as described in the sections that follow, spread wreckage over a wider area.
Wreckage recovery operations yielded over 126 554 kg (279 000 lb) of aircraft material, which represented approximately 98 per cent of the structural weight of the aircraft. Over 18 144 kg (40 000 lb) of cargo was also recovered.
220.127.116.11 Wreckage recovery methods
18.104.22.168.1 Initial wreckage recovery methods
Initial wreckage recovery activities included collecting debris from the surface of the water, searching shorelines, shallow water dive operations near shoreline areas, and deep dive operations at the debris field.
Divers from the Canadian Navy recovered the FDR on 6 September 1998 and the CVR on 11 September 1998. There was some delay in recovering the first recorder because both recorders were equipped with water-activated ULBs that were transmitting on the same frequency. Once the general area of the beacon signal was located, it was difficult to pinpoint the precise location of either of the recorders.
The ULB attachments were damaged to the extent that they had nearly become detached from the recorder. There is no regulatory requirement that the recorders be tested and certified with the ULBs attached.
Beginning on 12 September 1998, the USS Grapple, a United States Navy (USN) salvage ship, was on site for approximately three weeks, adding additional lift, dive, and ROV capabilities.
The continued use of divers to recover wreckage was assessed as hazardous owing to increasingly inclement weather; deteriorating sea state conditions; water depth; and the sharp, jagged state of the wreckage. It was also recognized that at the rate the wreckage could be recovered using this method, the majority of the wreckage would not be recovered in a timely manner, and that higher-capacity methods would have to be employed.
Between 6 804 and 9 072 kg (15 000 and 20 000 lb) of material was recovered during the initial recovery operations.
22.214.171.124.2 Heavy lift operations
Between 13 October and 24 October 1998, two contracted barges, moored together, were used to recover material from the debris field (see Figure 18). A heavy lift crane on the deck of one barge scooped wreckage from the seabed and placed it on the deck of the second barge, where it was sorted and washed. The wreckage was then transported to shore by CCG ships for further processing.
Approximately 68 040 kg (150 000 lb) of wreckage was recovered using this method.
126.96.36.199.3 Scallop dragger operations
A scallop dragger was used from late October 1998 to mid-January 1999. A scallop rake that was towed behind the vessel scraped the seabed and collected material into a chain-link mesh net. Working 24 hours per day when the sea conditions were suitable, 1 839 tows were completed.
Approximately 34 020 kg (75 000 lb) of wreckage was recovered using this method.
188.8.131.52.4 Remotely operated vehicle operations
Various ROVs were used throughout recovery operations to provide reconnaissance and recovery capability. A laser line scan and side scan sonar survey was performed to determine the extent of wreckage distribution and to provide detailed information about the seabed. Following the scallop dragger operation, the recovery area was prepared for the next phase by using ROVs to video tape the seabed in and around the site of the debris field. A CF ROV, called the Deep Seabed Intervention System, was used from 26 April 1999 to 14 July 1999 to recover material that would not be suitable for recovery by the planned suction dredge ship method.
Approximately 2 268 kg (5 000 lb) of wreckage was recovered during these operations, and considerable information about the type and location of the remaining debris was acquired.
184.108.40.206.5 Suction hopper dredge operations
The final phase of wreckage recovery was conducted in the fall of 1999. It involved dredging the area of the debris field to a depth of about 1.5 m (5 feet) to recover the remaining debris. The dredged material was pumped into the vessel's hopper and transported to Sheet Harbour, Nova Scotia, where it was off loaded into a prepared containment area.
The dredged material was then processed through a mechanical sifter to sort it by size, and deposit it on conveyor belts. The aircraft-related debris was then separated from the other material by hand as it passed by on conveyor belts. About 12 701 kg (28 000 lb) of wreckage was recovered using this method.
The sifting and extraction of aircraft wreckage at Sheet Harbour was completed on 3 November 1999, and the subsequent sorting of this recovered debris was completed on 4 December 1999, 15 months after the occurrence.
1.12.2 Aircraft wreckage examination
Recovered aircraft debris was transported to the CF facilities at Shearwater, Nova Scotia, where it was cleaned and sorted. Each item was examined by the Transportation Safety Board of Canada (TSB) and RCMP personnel with assistance from a large support team of specialists provided by Boeing (aircraft manufacturer), Swissair (operator), and SR Technics (maintenance company). Other investigation agencies, companies, and organizations provided additional specialists as requested by the TSB; for example, the NTSB, the FAA, the United Kingdom Air Accidents Investigation Branch, the Swiss Aircraft Accident Investigation Bureau (AAIB), the French Bureau d'Enquêtes et d'Analyse, the Air Line Pilots Association, Pratt & Whitney, and other companies were represented. Over 350 people participated in the wreckage sorting, examination, and investigation activities at Shearwater.
Recovered items were sorted and classified by their location on the aircraft and by their potential significance to the investigation. Particular emphasis was placed on debris exhibiting heat damage, burn residue, or unusual markings.
Detailed visual inspections and forensic analyses were completed by RCMP personnel to assess the possibility of explosive or incendiary devices having contributed to the observed damage. No evidence was discovered in the aircraft debris to suggest that criminal acts had contributed to the occurrence.
220.127.116.11 Aircraft reconstruction
A full-scale reconstruction mock-up was fabricated to support recovered portions of the forward section of the aircraft (see Figure 19). The original framework encompassed the portion of the aircraft above the cockpit and passenger cabin floors, from the front of the cockpit (STA 275) to STA 595, located within the first-class passenger cabin. Recovered portions of airframe primary structure and skin panels determined to have been installed at identifiable locations from the cockpit enclosure aft to approximately STA 595 were straightened, fracture matched, and installed on the reconstruction mock-up. The reconstruction mock-up was subsequently extended aft to STA 669; a second extension to STA 741 was added to the left side of the reconstruction mock-up to support recovered portions of the two forward air recirculation fans.
1.12.3 Examination of recovered electrical wires and components
The aircraft wiring was severely damaged by the forces of impact. Additional mechanical damage could have occurred to some of the wiring during recovery operations. Many of the wire segments had been broken into segments between 10 and 100 cm (4 and 39 inches) long.
All of the recovered wires were examined, primarily to identify any with signs of melted copper. As the fire did not reach temperatures high enough to melt copper,Footnote 50 any areas of melted copper would indicate that an electrical arcingFootnote 51 event had occurred.
Wire segments that showed signs of soot or heat damage, or that could be identified as being from the B section of the aircraft, were segregated from the other wires. The condition of the wires, heat damaged or not heat damaged, was used to help define the boundaries and heat pattern of the fire. The wire examination also assisted in explaining the spread of the fire and the loss of aircraft systems.
Recovered electrical components that had been installed within the fire-damaged area were examined for internal failures; such failures can be a source of heat, and therefore have the potential to be a source of ignition. Examination of these components did not show any evidence of their being involved in the initiation of the fire.
18.104.22.168 Control and tracking of electrical wires
Approximately 250 km (155 miles) of wire was installed in the aircraft. Although 98 per cent of the structural weight of the aircraft was recovered, it is estimated that a slightly lesser percentage of the wire was recovered. The examination of the recovered wire identified several wire segments that exhibited melted copper consistent with electrical arcing damage. Some of the arcing damage was too small to see without magnification. It cannot be assumed that all arced wires were recovered.
During the examination, any wire that was deemed to be of interest to the investigation was tagged, assigned an exhibit number, and entered into a wire database. The database increased to contain information on approximately 3 000 individual wire segments. Segments that exhibited melted copper, or showed signs of significant heating, were tracked through the same exhibit numbering system that was adopted to track pieces of wreckage. The wire segments that exhibited melted copper were further analyzed, which required that the melted sections be cut from the original segment. These individual melted copper wire sections were assigned new exhibit numbers and were tracked within the database. Where practical, the wire segments from the fire-damaged area that were identified as to their location in the aircraft were incorporated into the reconstruction mock-up (see Section 1.19.3).
22.214.171.124 Wires and cables with electrical arcing damage
When metal-to-metal contact occurs between an energized conductor and a source of electrical ground, or between an energized conductor and another conductor of different potential, a short-circuit is created. Typically, a short-circuit will result in an arcing event. Copper or aluminum wire that has arced will typically be identified by an area of resolidified metal (see Figure 20). After the arcing event, as the metal resolidifies from its molten state, it often forms a distinctive bead.Footnote 52 Short-circuit arcing will normally trip the associated CB, and typically result in a relatively small amount of conductor being melted.
In an arcing event, copper is vapourized and expands to many thousands of times its volume when in a solid state. High temperatures and pressures are generated in the localized vicinity by this vapourization and by the electrical discharge (arc) as it passes through the surrounding air. If flammable materials are nearby, they can be ignited by the heat of the electrical discharge, by the heat from the gases emanating from the area, or by the molten globules of copper that are typically ejected from the arc site.
With aircraft voltages of 115 V AC, an arcing event without physical contact is very difficult to obtain or sustain. However, in areas where wire insulation is destroyed in a fire environment there is an increased likelihood that such an arc can be initiated and sustained, and that the conductor will melt over some length. This rapid progressive arcing phenomenon, known as arc tracking, depends on numerous variables, the most predominant being the type of insulation used on the conductor.
Among the thousands of wire segments examined from SR 111, areas of melted copper were found on 21 exhibits that consisted of 17 individual wire segments, and 4 cable assembly segments that each comprise 3 separate spirally laid wires (3 individual wires twisted together to make up the one cable). All except one of the conductors that exhibited arcing had either polyimide or ETFE-type insulations. The one exception was a conductor insulated with a modified XL-ETFE (see information about Exhibit 1-3029 in Section 126.96.36.199).
Polyimide insulation does not melt when exposed to elevated temperatures; instead, it will pyrolyze,Footnote 53 or thermally degrade. Thermogravimetric analysisFootnote 54 of polyimide insulation in air shows that it begins to dissociateFootnote 55 at about 500°C (932°F) and will be completely dissociated by 650°C (1 202°F).
One of the characteristics of polyimide insulation is that under the correct conditions it can arc track, either wet or dry. Arc tracking can occur when the polyimide insulation decomposes from heat produced by either an electrical arc or by a fire. The exposure to heat produces an electrically conductive and thermally stable carbon char.Footnote 56 The resulting carbon deposit provides a current path to perpetuate the arc. This arcing can further cause the surrounding insulation to decompose, allowing the electrical discharge to propagate, or track, along the wire. In some cases, the current required to form an intermittent or sustained electrical discharge (arc tracking) is below the "current versus time" trip threshold for the associated CB. In these cases, an undetected fault condition, producing intense heat, will develop.
Frequently in an arc-tracking event, the heat from the initial localized electrical discharge will degrade the insulation on adjacent wires, causing a cascade of arcing and burning between multiple polyimide wires in a bundle. This is referred to as flashover. Flashovers can result in the catastrophic failure of entire wire bundles, resulting in the loss of power or signals to all equipment supplied by the affected wires.
Unlike polyimide insulation, ETFE insulation will melt and burn. It melts in the 260°C to 270°C (500°F to 518°F) range, and will burn with a flame when exposed to a fire at temperatures above 500°C (932°F). When the flame source is removed, ETFE insulation is self-extinguishing. The FAA testing of ETFE has shown that it will not support wet or dry arc tracking. The thermal decomposition of ETFE does not result in the formation of a conductive carbon char.
Testing has shown that although the ETFE insulation will melt and volatilize relatively quickly in a fire environment, it can be difficult to initiate a conductor-to-conductor or conductor-to-ground arcing event in a fire environment. The testing, using a butane flame to melt ETFE insulation, showed that it could take 20 to 30 minutes for arcing to occur between adjacent conductors. This suggests that a small creeping flame on an insulation blanket would be unlikely to degrade ETFE insulation and result in an arcing event in the time it would take for the flame to consume the available insulation blanket material and move away.
This testing also showed that in some cases the associated CB would immediately trip with the first arcing event; however, in other cases several arcing events would occur before the CB tripped. Neither the time to arc nor the tripping of the CB is predictable in a fire environment. If the initial arcing event does not trip the CB, arcing can occur on the same conductor some distance apart as the fire propagates and affects other sites on the wire.
In addition to the 21 exhibits that displayed copper melt, a single bead of once-molten copper, 2 mm (0.08 inches) in diameter, was recovered. This bead was found trapped in the damaged cooling fins on top of an emergency lights battery pack, which, based upon heat damage, was determined to have been located above the forward cabin drop-ceiling just behind the cockpit door. (See Figure 27.) This bead was likely fractured off, most likely during the impact sequence, from the end of an arced wire in the vicinity of the battery pack. No further determinations could be made about this bead.
One of the copper melts was not a result of arcing damage, but was determined to be the direct result of a welding operation during the manufacturing process of the wire (see Section 188.8.131.52).
184.108.40.206 Positioning of wires and bundles from exhibit 1-4372
During the wreckage recovery, one bundle of entangled wires was recovered that yielded 9 of the 20 wire segments that were found to have arcing damage. Collectively, this bundle was designated Exhibit 1-4372 (see Figure 21).
The wire insulation was missing from some of the wire segments, having been burned off by the fire or damaged by the fire and then stripped away at the time of impact. It is also possible that some additional wire insulation damage took place during the wreckage recovery process.
Several of the wire segments in Exhibit 1-4372 were identified as belonging to one of three aircraft wire runs (FAC, FBC, and FDC) (see Figure 7). As installed, these three wire runs, along with wire runs AAG, ABG, and the IFEN wire bundle, ran parallel to each other on the right side of the fuselage over top of Galley 2, between the cockpit rear wall at STA 383, and the aft end of Galley 2 at approximately STA 420. Just forward of the aft cockpit wall, the IFEN wire bundle entered one of two spare 102-cm (40-inch) long conduits that were installed between STA 383 and STA 420 (see Figure 5).
At STA 420, wire runs FAA, FBA, and FDA were broken out of wire runs FAC and FBC and FDC respectively. At STA 420, wire runs FAA, FBA, and FDA, along with wire runs AAG and ABG were routed over the crown of the aircraft to the left side of the fuselage. At STA 420, wire runs FAC, FBC, and FDC dropped down to run across the top of the forward passenger cabin ceiling; this routing was chosen to avoid contact between the bundles and the R1 door in the open position.
The recovered segments of wire runs FBC and FDC were each approximately 2.5 m (100 inches) long and had two wire clamps, identified as the marriage clamp, still attaching them together. The two wire runs were accurately positioned in the reconstruction mock-up based on the positive identification of individual wires, and by identifying the installed position of the marriage clamp at approximately STA 427. When these cable segments were positioned in the reconstruction mock-up, the forward end was located near the cockpit rear wall, and the aft end was located near STA 475. Accurate positioning of the segments from wire runs FDC and FBC, based on the known location of the marriage clamp, allowed for improved accuracy when positioning other wires from the same area. Heat damage patterns were used in the positioning of other wires from the same area.
220.127.116.11 Identification and description of arc-damaged wires from exhibit 1-4372
Of the nine wire or cable segments with areas of melted copper that were recovered from Exhibit 1-4372, four were positively identified as being segments of the IFEN PSU cables (1-3790, 1-3791, 1-3792, and 1-3793) (see Figure 22). This identification was based on remnants of coloured ETFE insulation remaining attached to the wires. On each of these four segments, one end was heavily matted, or crushed together, and the opposite end was fractured and frayed. Exhibits 1-3790 and 1-3792 both had distinctive regions where the tin coating was missing from the wire strands on all three wires. Exhibits 1-3791 and 1-3793 did not have a similar region of missing tin.
Of the remaining five segments, based on adhering remnants of ETFE insulation, four (1-3794, 1-3795, 1-3788, and 1-10503) were identified as segments of the 16 AWG IFEN 28 V DC control wire used to control the PSU outputs. The total length of these four segments was 97 cm (38 inches). The fifth (1-3796) was a segment of polyimide-film-insulated, nickel-coated 16 AWG wire. This wire segment could not be associated with a specific circuit; however, because it was nickel coated, it is known that it was not from the IFEN system.
The copper melt on Exhibit 1-3796 was unique in that it had an area of melted copper that encapsulated all of the outer wire strands over a distance of 2 cm (0.79 inches); however, the melted copper still had nickel-coated wire strands protruding at both ends, indicating that the heat was highly localized and confirming that an arcing event occurred.
When Exhibit 1-4372 was being untangled, Exhibit 1-3796 was removed from wire run FBC at a position corresponding to approximately 79 cm (31 inches) forward of the known location of the marriage clamp. Although this corresponds to a location aft of the cockpit wall, it cannot be confirmed that this is where this segment of wire had been installed.
Wire run FBC did not contain any 16 AWG wires; however, 16 AWG wires were contained in adjacent wire runs. FAC had 25, FDC had 2, and ABG had 1. In total, there were twenty-eight, 16 AWG wires routed, within these various wire runs, above the Galley 2 area. It could not be determined whether Exhibit 1-3796 originated from one of these cable runs, and if it did, which one.
18.104.22.168 Examination of the nine arced wires and cables
To assess whether the four IFEN PSU cable segments (1-3790, 1-3791, 1-3792, and 1-3793) and four control wire segments (1-3794, 1-3795, 1-3788, and 1-10503) had been located inside the conduit, they were submitted to the RCMP Chemistry Division (Ottawa and Halifax) for analysis. The single control wire (1-10503) was not submitted; except for one small piece of ETFE insulation, it was bare. The nickel-coated 16 AWG segment was also submitted to determine whether any FEP material had transferred to it during the impact sequence; this was to determine the proximity of this wire segment to the conduit. Furthermore, a request was made to identify any other materials found on these exhibits. Samples of the FEP conduit, the nylon clamps used to support the conduit, tie-straps, and other materials were supplied for comparative analyses. See Table 12 for the results of this testing.
Exhibit 1-3791 was also submitted to the Canadian DND Quality Engineering Test Establishment for further chemical analysis of the debris entrapped in the matted end, adjacent to the area of melted copper identified as Exhibit 1-14723.
Each of the four PSU cables consisted of three individual wires (three electrical phases). It was not possible to determine which wire had been used for which phase; therefore, each wire was arbitrarily labelled either phase A, B, or C.
Table 12 details the results of the physical and chemical examinations on the nine wire and cable segments recovered from Exhibit 1-4372. The matted ends of the four PSU cables were straightened. The cables were then measured from the straightened ends to determine the overall length of each phase and the distance to each arc location. Figure 22 depicts the locations of the arcs and other distinguishing features on the cables, relative to each other.
number of wires/gauge (AWG) wire length (cm)
|Melted copper on phase (ph) @ distance from straightened end (cm)||Chemical analysis||Other observations|
|FEP present (cm)*||Nylon (cm)*|
ph A - 88
ph B - 112
ph C - 100
|ph A - 11 (1-14746)
ph A - 62 (1-12652)
ph B - 77 (1-12651)
ph C - 69 (1-11182)
|0 to 15,
ph A - 46
ph C - 3
ph C - 13
ph C - 46
91 to 102
|86 to 97||Tin coating missing between 58 and 89 cm. Small pieces of red silicon rubber material 10 cm from end. Yellow fibreglass insulation embedded in matted end.|
ph A - 115
ph B - 116
ph C - 117
|ph A - 9 (1-14723)
ph A - 62 (1-12653)
ph B - 65 (1-12654)
|0 to 15,
ph B - 10
ph B - 37
ph B - 54
76 to 91
|91 to 107||1-14723 was within matted end of wires. Small pieces of red silicon rubber material and yellow fibreglass insulation embedded in matted end.|
ph A - 97
ph B - 97
ph C - 104
|ph A - 22 (1-12668)
ph B - 23 (1-12666)
ph B - 23 (1-12667)
|15 to 30
ph A - 45
ph A - 48
ph C - 53
ph C - 98
91 to 104
|0 to 15||Tin coating missing between 58 and 89 cm. Small pieces of red silicon rubber material 13 cm from end.|
ph A - 102
ph B - 120
ph C - 120
|ph A - 64 (1-12669)
ph A - 66 (1-12670)
ph A - 67 (1-12732)
|0 to 15,
ph B - 7
ph C - 37
ph C - 43
ph C - 54
45 to 61
|91 to 107||Small pieces of red silicon material 9 cm from end of longest wire at matted end.|
|End of wire - (1-11166)||9 (from melted end)||Frayed wire strands at opposite end of melted copper missing tin coating.|
|End of wire - (1-11167) and 2 cm from melted end (1-11168)||9 and 19 cm from melted end||Tin missing from outer wire strands over last 7 cm from melted end. Small pieces of red silicon rubber material noted between strands.|
|End of wire - (1-11173)||No FEP found||Tin missing from strands over 6 cm from melted end and again 10 cm farther along wire for 10 cm; tin was present over the last 6 cm.|
|End of wire - (1-11163)||Not submitted||Tin coating missing over 2.5 cm from melted end.|
|3 cm in from end of wire and 2 cm long
|No FEP found||Nickel-coated wire with a small piece of polyimide film trapped in wire strands.|
* The RCMP Halifax analysis reported FEP and nylon in ranges whereas the Ottawa analysis stated a distance from an end.
22.214.171.124 Examination of identified aircraft systems wires with copper melt
Four wire segments with regions of copper melt were positively identified from wire numbers marked on their insulation. Three of these four wires had a terminal lug connector still attached to one end, allowing the wires to be accurately positioned in the reconstruction mock-up.
All four of these wire segments originated from behind the overhead CB panel, which constitutes the upper part of the overhead switch panel (see Figure 23). The switch panels and CB panel are attached to a fibreglass enclosure, referred to as a "housing," within which terminal strips, bus bars, and other components are mounted. The wires are routed into and out of this housing through two holes located on the left and right sides of the aft end of the housing.
Exhibit 1-6976 consists of a segment of a 6 AWG nickel-coated, polyimide-insulated wire, approximately 102 cm (40 inches) long with the wire number B205-4-6 stamped on the insulation. This number identifies it as a segment of the left emergency DC bus feed wire. One end of the wire segment had two flag lugs attached that would have been connected to the left emergency DC bus bar located behind the overhead switch panel. The known location of the flag lug to bus bar connection allowed for this segment to be accurately located in the reconstruction mock-up. The end with the melted copper was located approximately 15 cm (6 inches) outside the right hole in the overhead CB panel housing. This placed it above the forward right side of the cockpit ceiling.
There was a 2-cm (0.8-inch) long section of resolidified copper located about 97 cm (38 inches) from the flag lugs. The nickel coating was missing from the conductor, for about 6 cm (2.4 inches) on either side of the melted area. The outer surface of the resolidified copper was smooth and did not exhibit any of the normal characteristics associated with an arcing event, such as surface porosity or irregular surface structure. Radiographs of this area showed it to be a solid mass, without voids. This was the only nickel-coated wire segment that exhibited melting of the nickel coating beyond the area of the resolidified copper. This melted copper was considered to have been the direct result of a welding operation during the manufacturing process of the wire.Footnote 57
Welding or "splicing" is done to avoid interruptions during the wire manufacturing process. Spliced joints are required to be flagged and removed prior to the wire being installed in an aircraft. If not removed, such a solid piece of copper conductor, especially larger gauge wires, such as the 6 AWG wire, can be susceptible to fatigue cracking. The left emergency DC bus feed wire was installed in the occurrence aircraft in a location where the wire run was relatively straight, and the vibration potential was low. These mitigating factors would reduce the risk of fatigue cracking; there was no sign of fatigue cracking in the melted area of Exhibit 1-6976.
Exhibit 1-3029 was identified by the wire number B205-1-10 as being a segment of the left emergency AC bus feed wire (see Figure 20). Although this wire was identified by the Boeing wiring database as a nickel-coated, polyimide-insulated wire, it was in fact an XL-ETFE (BXS7008) insulated tin-coated wire. The recovered segment was approximately 122 cm (48 inches) long. One end of the wire segment had two flag lugs attached, which would have connected it to the left emergency AC bus bar. The end opposite the flag lugs exhibited melted copper on the surface of the conductors. As installed, the end with the melted copper would be located approximately 15 cm (6 inches) outside of the right oval hole in the overhead switch panel housing, and in the immediate vicinity of the melted copper on the left emergency DC bus feed wire. The insulation remained intact on this wire, from the flag lug to within 17.5 cm (7 inches) of the melted copper at the other end.
Exhibit 1-1733 was identified by wire number as a segment of B203-974-24, a 24 AWG nickel-coated, polyimide-insulated wire that was identified as part of the Engine 2 fire detection loop "A" circuit. The recovered segment was approximately 39 cm (15 inches) long. One end of the wire segment was attached to a remnant of module block 46 that was originally attached to modular track S3-613, located on the right side of the overhead switch panel housing. The other end of the wire segment exhibited melted copper. The known location of the module block allowed it to be relocated in the reconstruction mock-up of the overhead housing. This placed the area of melted copper approximately 15 cm (6 inches) outside the right oval hole of the overhead switch panel housing.
Exhibit 1-12755 was identified by wire number as a segment of B203-189-22, a 22 AWG nickel-coated, polyimide-insulated wire that was part of the high-intensity lights (supplemental recognition) wingtip strobe lights. The recovered segment was approximately 81 cm (32 inches) long. This wire segment exhibited melted copper on one end, and frayed wires at the other. The frayed wire end did not appear to have had a terminal lug or pin attached to it; it appeared to be a segment from a longer wire. As installed, this wire was routed from the push button switch S1-9094, identified as HI INTENSITY LTS, located in the overhead switch panel, to plug P1-420 pin X located on the overhead disconnect panel behind the upper avionics CB panel. The area of melted copper could not be accurately positioned between the start and end points but the wire was routed in wire runs AMJ and AMK, which are routed out the oval hole in the right side of the overhead switch panel housing.
126.96.36.199 Examination of remaining unidentified wires
The remaining eight wires with arc damage could not be identified regarding their function, nor could their specific location within the aircraft be determined. Table 13 contains a description of these eight wires.
|Exhibit number||Length (cm)/Wire size/Wire coating/Insulation new exhibit number||Melted copper||Observations|
|1-4689||19 cm/10 AWG/tin coated/
no insulation remaining
|0.2 cm from end. Copper melt encompasses 8 to 9 wire strands 0.3 to 0.5 cm long and 1 to 2 mm wide. Numerous cavities and voids in melt.||Tin coating missing from wire strands. Both ends frayed. Polyimide film caught in strands but could not positively determine whether it is from this wire.|
|1-11897||16 cm/10 AWG/tin coated/
no insulation remaining
|Both ends melted.
Straight end of wire 14 cm from curved end.
6 cm from curved end.
|Wire embrittled from end to end.|
|1-12756||40 cm/18 AWG/tin coated/polyimide film
|Melted copper over 0.2 cm long, 0.8 cm in from one end and encompassing 8 to 10 wire strands. Numerous voids and craters in melt.||M81381/21 (polyimide insulated/tin coated).|
|1-11252||7 cm/24 AWG/nickel
|Melted copper at end extending 0.15 cm down wire. Small bead of copper fused to strands adjacent to melted end.||Wire embrittled from end to end. Nickel coating missing in some areas and charred or blackened material adhering to strands.|
|1-3713||9 mm/24 AWG/nickel
|Melted from end to end with no obvious coating remaining.||Numerous voids and holes through wire. No insulation remaining.|
|1-12809||25 cm/24 AWG/nickel
|1.2 cm from one end 0.2 cm long encompassing all strands with a small bead protrusion.||No insulation remaining.|
|1-3700||10 cm/20 AWG/nickel
|End of wire melted over 1 cm with a 1.5 mm bead on end.||No insulation remaining.|
|1-3718||28 cm/20 AWG/nickel
|End of wire melted over 0.6 cm ending in a flatted point.||No insulation remaining. Melt area blackened from smoke.|
1.12.4 Examination of flight crew reading lights (Map lights)
The first officer's map light was recovered and examined for electrical arc or heat damage and none was present. The light bulb was still attached to the lamp socket. The lamp filament had fractured into many pieces, indicative of the filament being cold, or off, at the time of impact. Typically, when an incandescent filament is severely impacted while illuminated, it will stretch in a characteristic fashion.
Portions of the right observer's map light, including the ball cup, were recovered and examined. There was no sign of arcing or heat damage; however, the majority of the electrical contact parts were missing. The aluminum housing in which the light was mounted had some soot accumulation on the outer surface but was not heat damaged. Two short lengths of wire, white and red, were visible inside the housing. The white wire exhibited a mechanical fracture; neither wire exhibited evidence of arcing or heat damage. The light bulb was not recovered.
Several pieces of Hella map light were recovered and examined. Because the internal components of the map light and bunk lights are identical, it was not possible to determine to which light these pieces belonged. None of these pieces showed signs of arcing or heat damage.
Two ball cups were also recovered. Based on the physical damage and extent of sooting, they were considered to have been from either the captain's or first officer's map light.
See Section 1.16.2 for additional details regarding map light investigation research and testing, and Section 4.1.4 for follow-up safety actions taken.
1.12.5 Examination of cabin overhead aisle and emergency light assemblies
The passenger cabin was equipped with overhead aisle and emergency light assemblies manufactured by Luminator Aircraft Products (PN 0200486-001). These light assemblies were installed in the bridge/gap assemblies that support the ceiling panels used throughout the passenger cabin above the left and right aisles. Each light assembly includes both an aisle light and an emergency light; however, only the aisle light is illuminated during normal operations. A few recovered bridge/gap assemblies exhibited a single black circular mark and some brown discolouration adjacent to the area where the aisle and emergency light assemblies are mounted.
During subsequent examinations of other MD-11 aircraft, the same discolouration pattern was found on the bridge/gap assemblies. In addition, some aisle light lens covers were found to be deformed. Testing was conducted using temperature measurement strips to determine the temperatures reached within the lens cover adjacent to the lamp and also adjacent to the outside of the aisle light assemblies during normal aircraft operations. Peak internal temperatures of approximately 200°C (392°F) were noted, with average temperatures between 143°C and 160°C (289°F and 320°F). Temperatures between 110°C and 138°C (230°F and 280°F) were measured on the outside of the light assemblies. Discolouration on the bridge/gap assemblies was a result of the heating effects of the aisle light lamp. It was noted that the amount, and frequency, of heat damage increased the longer the light assemblies were in service.
Some of the cabin overhead aisle and emergency light assemblies examined were found contaminated with a heavy build-up of dust and lint. Some contamination was also noted on light ballasts, wire harnesses, and electrical terminal strips and connectors, as well as in some areas above the forward cabin drop-ceiling and elsewhere in the aircraft. In some forms, dust and lint can be highly combustible and may be ignited from a small ignition source.Footnote 58 Concentrations of dust and lint could provide a path for fire propagation. Microscopic examination and analysis of dust and lint collected from filters removed from Swissair aircraft indicated that the deposits consisted of a mixture of different materials, such as textile and paper fibre fragments. The deposits were determined to be flammableFootnote 59 and easily ignitable from a small ignition source.
1.12.6 Examination of standby instruments
The SAI was recovered and examined to determine whether it was electrically powered and functional prior to impact, and to determine whether the indicator could help determine the attitude of the aircraft at the time of impact. The indicator's casing was extensively deformed from impact damage. This deformation resulted in capturing the pitch and roll indicators at approximately 110 degrees right bank and 20 degrees pitch down. The attitude scale showed a distinct red imprint that matched the shape and size of the red warning flag. The flag comes fully into view in less than one second with the loss of electrical power to the unit, or if the rotational speed of the gyro falls below 18 000 rpm. The location of the imprint showed that the warning flag had been fully displayed at the time of impact.
The shaft of the gyro rotor mass was fractured in torsional overload; there were superimposed rotational rub markings. Both the rotor mass, and the housing, exhibited surface rub. There was a transfer of machine tool markings between the two. This is indicative of there having been high rotational speed when the rotor mass contacted the enclosure, which would have occurred when the support shaft fractured. Therefore, it is concluded that at the time of impact, the gyro was rotating with high rotational energy.
If electrical power to the SAI is lost, the rate of spool-down of the gyro will allow the indicator to continue to provide reliable attitude information for five to six minutes. Electrical power to the unit is provided from the aircraft's battery bus, through CB C-01 located on the overhead CB panel.
The only part of the standby altimeter/airspeed indicator that was identifiable was the airspeed dial drum. The dial drum was extensively deformed; however, it exhibited two distinct indentations at the 80 knot and 120 knot graduations. These two indentations appear to have been made at the time of impact by contact with two internal supports that were located at the rear of the indicator, but in close proximity to the drum as it rotates. Using a serviceable airspeed indicator, the indentations on the airspeed dial drum were lined up with the internal supports. The comparison placed the 300 knot graduation at the airspeed index mark, indicating that the aircraft was travelling at about 300 knots at the time of impact.
1.12.7 Examination of flight controls
The flight control system actuators were examined; there was no indication of a pre-impact fault within the actuator assemblies that would have affected their normal operation. Based on this examination, the flaps were extended to 15 degrees; however, the slats were not extended as would be expected with flap extension. Electrical power is not required for flap extension; however, it is needed for slat operation. The failure of the slats to extend was likely the result of an interruption in electrical power to the slat control valves owing to the effects of the in-flight fire.
With a flap extension of 15 degrees, the outboard ailerons would have become active. The spoilers (speed brakes) were retracted at the time of impact; however, it is unknown whether they were deployed at any time during the descent below 10 000 feet after the loss of the FDR. Impact markings on the elevator, rudder, and aileron actuators, along with the as-recovered positions of the horizontal stabilizer jack screws indicate the following possible aircraft flight control configuration at the time of impact: 2 to 3 degrees up-elevator; 3 degrees left rudder; and ailerons and horizontal stabilizer in a neutral position.
The FDR recording, just prior to the loss of the FDR, showed no anomalies with the flight control systems. The last valid recordings indicated that the autopilot had disengaged and the upper and lower yaw damper A control was lost (the upper and lower yaw damper B control was still available). When the FDR recording stopped, the aircraft was in a "clean" configuration, with the flaps, slats, and landing gear retracted.
1.12.8 Examination of fuel system components
All 17 of the 115 V AC motor-driven fuel pumps were recovered, and all but two were specifically identified as to their installed location. Each fuel pump receives electrical power from one of the three AC generator buses, and each pump in each of the fuel tanks is powered from a different electrical power source. All of the pumps were examined at the fuel pump manufacturer's facility to determine whether they were being electrically driven at the time of impact, which would provide information about the status of the electrical buses.
The fuel pump examination focused on identifying distinctive damage that would indicate whether the pumps were operating (turning) at the time of impact. Distinctive damage included gouge marks on the impeller housing, denoting contact between the housing and the rotating or stationary impeller blades, and damage to the pin-and-slot arrangement that holds the impeller to the rotating shaft. The damage showed that six pumps had high rotational energy at the time of impact, indicating that their impellers were being electrically driven.
Fuel Tank 2 left aft boost pump housing displayed distinct imprints that were caused by the impeller while it was stationary; it was determined that this impeller was not being electrically driven at the time of impact.
A determination of the operational status of the remaining pumps could not be made, as there was lack of physical damage, and therefore no definitive marks. Table 14 identifies the six fuel pumps that were determined to have been operating at the time of impact and the source of electrical power associated with each.
|Fuel pump location||Electrical bus|
|Tank 1 Forward Boost Pump||115 V AC Generator Bus 1|
|Tank 3 Transfer Pump||115 V AC Generator Bus 1|
|Upper Auxiliary Right Transfer Pump||115 V AC Generator Bus 1|
|Tail Tank Left Transfer Pump||115 V AC Generator Bus 1|
|Tank 1 Aft Boost Pump||115 V AC Generator Bus 3|
|Tank 2 Transfer Pump||115 V AC Generator Bus 3|
Both fuel dump valves were recovered and examined. The observed damage and gouge marks indicate that both valves were in the CLOSED position at the time of impact.
The auxiliary tank fill/isolation valve, and the tail tank fill/isolation valve, were recovered and examined. Impact forces captured the valve slides in both valves in the CLOSED position at the time of impact. In accordance with the known fuel system configuration and normal FSC operation, the tail tank fill/isolation valve would be expected to be closed. However, the auxiliary tank fill/isolation valve should have been open at the time of impact, unless either electrical power was not available to open it or fuel dumping had been initiated at some point. That is, during fuel dumping, the fuel system is reconfigured to close the auxiliary tank fill/isolation valve.
Only portions of the three cross-feed valves were recovered; the position of their valve slides at the time of impact could not be determined.
1.12.9 Examination of the engines
The three engines were examined to determine their operational status just prior to impact. Each engine is capable of producing a maximum thrust of 62 000 lb at sea level. No engine mechanical failures were discovered that could have prevented any of the three engines from operating normally.
The electronic circuit boards from the Engine 1 FADEC were recovered; however, the electrically erasable programmable read-only memory (EEPROM) chip containing the NVM had been stripped from the circuit board. As a result, no recorded FADEC information for Engine 1 was retrieved.
The FADECs from engines 2 and 3 were recovered, and information was extracted from the NVM in each of the units. These FADECs recorded 10 identical faults for the occurrence flight. Engine 2 FADEC recorded an additional 10 faults, 7 of which were duplicates of the previous 10 faults (see Section 188.8.131.52). All of the faults recorded on the FADEC NVM occurred after the aircraft had descended to approximately 10 000 feet. All of these faults were related to the loss of inputs from both of the aircraft's FCCs and ADCs, and the loss of 115 V AC and 28 V DC electrical power to the FADECs.
The disruption of 115 V AC electrical power resulted in the loss of inlet probe heat to the associated engine. Inlet probe heat is required to allow the FADEC to control engine speed in the primary EPR mode; therefore, with the loss of inlet probe heat, the engine control mode would have reverted from the primary EPR mode to the soft reversionary N1 mode. The FADEC then establishes a down-trimmed N1 schedule to maintain the same thrust level as prior to the reversion. A SELECT switch is provided on the FADEC control panel, which is part of the overhead panel, to allow pilots to remove the downtrim from the N1 schedule; the engines then operate in the hard reversionary N1 mode. The engine will respond to throttle inputs in either reversionary N1 mode.
Faults are recorded within the FADEC in 20-minute accumulated increments and are not synchronized with aircraft FDR time. This makes it difficult to correlate any fault written to the FADEC memory with aircraft UTC time. Therefore, it was not possible to precisely correlate the FADEC faults with FDR recorded information.
184.108.40.206 Engine 1
Impact damage to Engine 1 was consistent with an engine operating at a high rotational speed and producing high power at the time of impact. Impact marks were left on the throttle shaft and throttle quadrant when the throttle fractured free of the pivot shaft. When the impact marks were aligned, the position of the throttle lever was determined to be consistent with a thrust level of approximately 45 960 lb in the EPR mode of control, or 54 195 lb in the hard reversionary N1 mode of engine control. It is unknown whether the pilots had selected the hard reversionary N1 schedule mode of engine control.
The metering valve in the fuel metering unit (FMU) was at or near the maximum fuel-flow position, equating to a fuel flow of between 26 900 and 28 400 lb per hour. This is consistent with a high-power setting.
220.127.116.11 Engine 2
The impact damage to Engine 2 was consistent with an engine that was rotating at a windmill speed and not producing power at the time of impact. Impact marks were left on the throttle shaft and throttle quadrant when the throttle fractured free of its pivot shaft. There were two impact marks on the throttle quadrant. When the impact mark on the throttle shaft was aligned with one of the marks on the throttle quadrant, the throttle was in a position similar to that of Engine 1. When the second mark on the quadrant was aligned, the throttle was in approximately the idle position. The damage associated with this second mark on the throttle quadrant was assessed to be the result of post-crash movement. Therefore, it is concluded that the throttle lever was in the forward position at the time of impact, even though the engine was not producing power.
Of the 10 additional fault entries recorded on the Engine 2 FADEC, 3 were related to the loss of TRA inputs to the FADEC. The TRA wiring for Engine 2 is routed from the centre pedestal, above the cockpit ceiling, and then aft through an area of known fire damage in the forward cabin drop-ceiling. The loss of TRA inputs would cause Engine 2 to revert to a fixed thrust mode, and to maintain power at the last validated throttle angle. As the FDR had stopped recording, the EPR values were not available. The last recorded thrust settings obtained from the FADEC before the engine was shut down were approximately 72 per cent N2, or approach idle.
FADEC information indicates that Engine 2 was shut down at an altitude of about 1 800 feetFootnote 60 and airspeed of 227 knots TAS. The rewriting of existing faults in the FADEC NVM can normally only occur if the engine is shut down by the selection of the FUEL switch. In the case of SR 111, the possibility of the electrical circuitry to the switch being compromised by fire damage was also considered. The wiring in the aircraft is such that selection of the FUEL switch causes two electrical circuits to become grounded, and one electrical circuit to become powered. As two of the three associated wires were in wire runs completely outside of the fire-damaged area, it is considered improbable that fire damage to the wires could have occurred coincidentally to produce this precise electrical configuration. Therefore, it was determined that the pilots purposely shut the engine down by activating the FUEL switch.
18.104.22.168 Engine 3
Impact damage to Engine 3 was consistent with an engine that was producing power above flight idle, but not at full power. Because the engine had lost the pitot heat input signal to the FADEC, the engine would have reverted to the down-trimmed N1 mode. Impact marks were left on the throttle shaft and throttle quadrant when the throttle fractured free of its pivot shaft. When the impact marks were aligned, the position of the throttle lever was determined to be consistent with a thrust level of approximately 40 315 lb in the EPR mode. Because the engine had lost the pitot heat input signal to the FADEC, the engine would have reverted to the soft reversionary N1 mode. Therefore, based on only the throttle position indications, the engine thrust levels would have appeared to be at a relatively high power setting.
However, the FMU provides different information. The metering valve in the FMU was determined to be at an intermediate position equating to a fuel flow of between 3 180 and 3 420 lb per hour. This fuel flow is consistent with a power setting just above flight idle. The information derived from examining the FMU provided a more accurate representation of engine status than was provided by the throttle position impact marks. Also, the physical damage to the engine is consistent with a low-to-medium power setting as indicated by the FMU setting; the analysis of the associated engine components further indicates that the engine was operating at or slightly above flight idle at the time of impact.
1.12.10 Examination of aircraft structural components
Specific structural components were identified in the main debris field from all extremities of the aircraft, from nose to tail, from left wingtip to right wingtip, and from belly to fin. A performance analysis determined that the aircraft did not accelerate to a speed that could result in aircraft structure separating prior to the time of impact, nor is there any other indication of such structural failure. There was no indication that the fire had burned through the structure, or that any of the structure had separated as a result of fire damage.
22.214.171.124 Empennage and wings
Pieces of the aircraft structure over 1.22 m (4 feet) long were examined for damage patterns that might help determine the attitude and configuration of the aircraft at the time of impact. These larger pieces were considered the best for providing the clearest patterns showing the deformation of the structure as a whole.
The deformation and fragmentation damage to the two horizontal stabilizers was relatively symmetrical. However, the right stabilizer displayed slightly more damage, which suggests that the right side contacted the water before the left side.
No conclusive deformation or fracture patterns were observed in any of the rudder pieces.
The deformation and fragmentation patterns of the two wings was relatively symmetrical. Therefore, it was concluded that there were no significant differences in the magnitude and orientation of the impact forces that acted upon them. Close examination of wing skin bending and torsion, stringer damage, shear clip damage, spar damage, rib damage, slat track bending, and engine pylon attachment fitting damage found subtle differences that suggested that the left wing may have sustained greater damage, and that the aircraft may have been yawed nose right at the time of impact. However, the differences were so subtle and involved such a small number of pieces that they were inconclusive. Owing to the lack of information, no determination could be made, based solely on the wing examination, about the angle of bank or pitch angle of the aircraft at the time of impact.
126.96.36.199 Cabin Outflow Valve Doors
The cabin outflow valve doors were examined to determine whether they were open or closed at the time of impact. Although there were numerous scratches, gouges, and dents on the surfaces and edges of both doors, none of these marks were continuous across both doors. This suggests that the doors were not closed when these marks were made. Additional marks made by the deformation of the door frame and the bending of the door hinges indicates that both doors were open to some degree at the time of impact.
When opening, the forward door swings outward away from the fuselage into the airstream and the aft door swings inward into the left tunnel area. Light to moderate soot was observed in areas on the exterior skin of the aft door, and light soot was observed along the hinge line of the forward door. The observed soot pattern is consistent with the doors being in an open position for a sufficient length of time to permit the doors to become sooted from the fire effluent.
188.8.131.52 Cockpit sliding clearview windows
The MD-11 is equipped with two sliding clearview cockpit windows (one on each side of the cockpit) that are normally closed and latched during flight. These windows can be opened by the pilots when in unpressurized flight; this action is part of the Swissair Smoke/Fumes Removal checklist. The structure around the clearview windows was examined to determine whether they were open, or closed and latched, at the time of impact.
The cockpit clearview windows are plug-type windows that rest against a flange around the perimeter of the sill. Each window can be moved through a crank-and-chain mechanism located on the bulkhead below the windowsill. To open the window, the locking mechanism is first released by the pilot. This preliminary action releases the latches on the aft edge of the window, but does not move the window. The initial turning of the hand crank pulls the aft edge of the window inboard enough to clear the sill, allowing the window to slide aft when the crank is further turned. The window can be unlocked when the aircraft is pressurized, but the outward force on the window is so great that turning the hand crank cannot open the window.
The damage to two of the three latch plates on the first officer's clearview window was aligned with the locked position and the damage had the same shape as the ends of the latches. This is consistent with the latches having been locked at the time of impact. The separation of the third latch plate was consistent with the direction of the damage to the first two. This damage pattern is consistent with the window having been closed and latched, and forced inboard by the impact with the water.
The damage to the three latch plates, as well as the latching mechanism, window, and sill on the captain's window, were consistent with the latches having been unlocked at the time of impact. There were also impact marks along the sill that were consistent with the pitch and location of the fasteners around the perimeter of the window. In most cases, the depth of these gouge marks penetrated both the paint and primer, and indented the metal. This is consistent with the window having been in the closed position at the time of impact.
1.12.11 Examination of flight crew and passenger seats
184.108.40.206 Flight crew seats
The seat belts from the captain's seat were not fastened at the time of impact, and the seat was in the egress position. The seat was broken away at the time of impact by a force having a vector component acting from right to left. There was no clear indication regarding whether the seat was occupied at the time of impact.
The first officer's seat, which had broken away from its support, was facing forward in a normal flying position, and the seat belts were fastened at the time of the impact. The seat was occupied at the time of impact.
The right observer's seat, which had broken away from its support, was facing forward in the fully aft and fully left position at the time of impact. The seat belt was unfastened. It could not be determined whether the seat was occupied at the time of impact.
Light yellow-coloured regions were found on the cockpit sheepskin seat covers. Microscopic analysis revealed that this discolouration was created by the presence of countless small tufts of light yellow fibreglass particles, which were embedded and intertwined in the grey wool fibres of the seat covers.
220.127.116.11 Passenger seats
The passenger seats sustained a high degree of impact-related damage; therefore, identification and reconstruction of individual seats was not possible. The extent of the damage also prevented any determination of whether any particular seat was occupied at the time of impact.
1.12.12 Aircraft attitude and airspeed at the time of impact
The location of the debris field in relationship to the last primary radar return shows the aircraft was in a right turn prior to the time of impact. The debris field was relatively compact and supports a relatively steep water entry. The standby attitude display showed the aircraft to be at 20 degrees nose down and 110 degrees right bank at the time of impact. The dial face on the airspeed indicator had marks, made at the time of impact, that correspond to an airspeed of 300 knots. The structural damage indicates that the aircraft had a nose-down attitude of about 20 degrees, and a right bank in excess of 60 degrees. Analysis of the markings on various wreckage pieces indicated that the impact force was from 15 degrees right of the aircraft centreline.
1.13 Medical information
This section summarizes the post-accident medical and pathological information of the occupants on board SR 111. Medical history information pertaining to the pilots is provided in Section 1.5, Personnel Information.
1.13.1 Recovery of occupants
The force of the aircraft's impact with the water was such that human remains were fragmented. One passenger, who was a licensed pilot, had a life vest on. For most of the other occupants, it was not possible to determine whether life vests had been donned, although it was determined that the M/C was not wearing his life vest.
The condition of the remains was also affected by the extreme post-impact environmental conditions. Within days after the accident, it became evident that human remains could only be recovered as the wreckage was recovered.
1.13.2 Identification of individuals
The identification of passengers and crew was carried out by a team consisting of the chief medical examiners of the provinces of Nova Scotia and Ontario, the RCMP, DND personnel, and others from the local medical community. One passenger was identified by visual means. The remaining 214 passengers and 14 crew members were identified through a combination of dental record comparison, fingerprint matching, forensic radiography, and deoxyribonucleic acid (DNA) protocols. All 229 occupants of the aircraft were identified by December 1998.
1.13.3 Injury patterns
All passengers and crew died instantly from a combination of the deceleration (g)Footnote 61 and impact forces when the aircraft struck the water. The degree of injury suggests that the longitudinal impact forces were in the order of at least 350 g. There were no signs of exposure to heat found on any of the human remains that were recovered. The injury patterns were consistent with fore and aft forces with a right lateral component of about 15 degrees, which is consistent with the information related to attitude of the aircraft at the time of impact.
1.13.4 Toxicological information
Toxicological analysis of selected specimens from the human remains was undertaken, including both SR 111 pilots, at the FAA Civil Aerospace Medical Institute to determine the presence or absence of products of combustion from the in-flight fire, in particular, carbon monoxide and hydrogen cyanide. The presence of either of these compounds in the specimens could indicate inhalation of smoke or fumes, or both, which would have assisted in providing some insight regarding the status of the cockpit and cabin environment prior to the time of impact.
None of the toxicological specimens submitted for testing were suitable for meaningful analysis of carbon monoxide. No cyanide was found in any of the specimens. This result may reflect the absence of sufficient smoke within the cabin for the cyanide compound to be absorbed in the tissues, or may reflect the unsuitability of the tissue specimens available for testing.
Both pilots were identified through DNA testing. Although carbon monoxide testing was attempted for both pilots, no useful results could be obtained because suitable toxicological specimens were not available. No cyanide was detected in either pilot. The absence of cyanide may be the result of the protection provided by the flight crew oxygen mask or other personal protective equipment, or of the unsuitability of the tissue specimens available for testing.
It is not unusual for ethanol to be detected during toxicological testing of aviation accident victim tissue specimens. Post-mortem ethanol production is the result of bacterial action and is part of the putrefaction process. The presence of ethanol depends on various factors, such as the nature and condition of the specimen; the environmental conditions to which the specimen tissues are exposed; the time duration before the specimen is recovered; and the opportunities for bacterial contamination to take place prior to, and during, the tissue recovery selection and handling process. To confirm the presence of suitable conditions for this phenomenon to occur, other specimens were tested from individuals who would not have been expected to have ingested alcohol because of age or cultural background. Of the six specimens tested, five tested positive for ethanol.
The remains of the pilots were tested for alcohol and drugs; no drugs were detected. There was no indication that either pilot ingested alcohol prior to, or during, the flight. Positive results for ethanol were obtained for both pilots; positive results can be the result of either ante-mortem ingestion or post-mortem production. Results obtained from specimens from other individuals confirmed that conditions existed for post-mortem alcohol production.
This section describes the aviation standards in place at the time of the SR 111 occurrence with respect to flammability, fire detection and suppression, and firefighting. It also describes the nature of the fire and heat damage, as well as potential ignition sources and fuel sources.
1.14.1 Aircraft certification standards
18.104.22.168 Development of material flammability standards
Among the CAAs, the FAA has traditionally taken a lead role in research and development to improve fire safety in aviation. In 1988, the United States Aviation Safety Research Act mandated the FAA to conduct fundamental research related to aircraft fire safety. The FARs are used internationally as the primary source for aircraft certification requirements, including material flammability standards. Current FAA regulations reflect a philosophy adopted following a study in 1975 to 1976 to determine the feasibility of, and the trade-offs between, two basic approaches to providing fire safety improvements to a modern, wide-bodied transport aircraft fuselage. The purpose of the study was to examine the impact of in-flight, post-crash, and ramp fires on fuselage compartments, and assess the fire protection requirements.
The first approach looked at the potential of applying the latest available technologies in early-warning fire-detection and fire-extinguishing systems. This approach would involve what was described as a "fire management system"; that is, one that would incorporate fire detection, monitoring, and suppression throughout the aircraft.
The second approach looked at the potential for improving the flammability standards of materials to be used in cabin interiors so that they would have high fire-retardant qualities, and low emissions of smoke and toxic gas.
The study concluded that there were merits and limitations to each approach, and that an approach combining a fire management system with selective material improvements may offer the most potential for providing timely fire protection in all cases.
Subsequently, as recommended in the FAA's SAFERFootnote 62 Advisory Committee report, the FAA's main research and development efforts were directed toward what was determined to be the greatest threat: a post-crash fire. The post-crash fire scenario that was envisioned was an intact fuselage adjacent to a fire being sustained by uncontained aviation fuel. It was determined that the most significant threat to surviving passengers in such a scenario would be from burning cabin interior materials. FAA research concluded that in such a scenario, surviving passengers could become incapacitated owing to toxic gases generated by a phenomenon known as "flashover."Footnote 63 Therefore, to increase survivability, the FAA concentrated its efforts on improving the flammability standards for cabin interior materials to delay the onset of flashover.
In-flight fires were considered to be rare, and the FAA concluded that the best defence against them would be through the use of cabin materials that had high fire-containment and ignition-resistance properties, and through the use of fire detection and suppression devices in "potential fire zones."
Research and development related to in-flight fires has led to increased fire protection in areas such as cargo compartments and lavatories.
22.214.171.124 Material Flammability Standards - Testing Procedures
As part of the FAA aircraft certification process, materials to be used in the construction of aircraft are required to meet specified performance (test) criteria or standards when exposed to heat or flame. These flammability test criteria are designed, in principle, to expose a given material to a representative in-service fire environment. When deciding on the type and amount of testing for a particular material, assessments are made of the composition of the material, the quantity to be used, and its location within the aircraft. The testing is designed to measure the tendency of each material to ignite and propagate a flame.
For the majority of materials used in the pressure vessel, the flammability tests in place at the time the MD-11 was certified consisted primarily of a variety of Bunsen burner tests. A single Bunsen burner was used as the ignition source. Each test could be varied in several ways. For example, the orientation of the material to the flame could be varied from the horizontal through to the vertical. The orientation was specific to the test objectives, which were based on the perceived threat. The vertical burn test would normally be the most severe. Also, the length of time that the material was exposed to the flame could be varied. A longer exposure time would normally equate to a more severe test.
For each of the various Bunsen burner tests, requirements were established to differentiate between a pass or a fail for the material being tested. The following is a list of criteria that could be used to measure a material's flammability characteristics:
- Ignition time (how long it takes the material to ignite when exposed to the Bunsen burner flame; the tests typically use either 12, 15, 30, or 60 seconds of flame exposure);
- Glow time (the average time the material continues to glow after the ignition source is removed);
- Flame time (the average time the material continues to produce a flame after the ignition source is removed);
- Drip flame time (the average time that any dripped material continues to produce a flame);
- Burn length (average value for burn length measured to the nearest 0.3 cm (0.1 inches)); and
- Rate of burn (measured in inches per minute).
In accordance with individual Bunsen burner test requirements, the performance of the material was averaged over a minimum of three test specimens.
Except for selected materials in Class C cargo compartments, the most stringent material flammability standards were applied to those materials that were to be used in the occupied areas of the aircraft. Of particular interest were large surface panels, such as side walls, ceilings, stowage bins, and partitions. Not only were the materials used in the panels subjected to the most aggressive test procedures, the materials also had to be self-extinguishing; that is, they would not propagate flame beyond a certain distance, typically less than 20 cm (8 inches). Cabin materials were also subjected to tests for heat release and for smoke. No testing was required for toxicity.
As a consequence of the testing requirements, less stringent material flammability standards were applied to those materials that were intended for use within the pressure vessel but that were outside the occupied areas. Certain materials only required the horizontal Bunsen burner test. To pass, the material could not exceed a certain rate of burn. Depending on the intended use of the material, the rate of burn could not exceed either 6 or 10 cm (2.4 or 4 inches) per minute. No requirement existed for these materials to be self-extinguishing.
In effect, the different flammability testing requirements, as described above, resulted in the following material flammability hierarchy:
- Materials that would self-extinguish within an acceptable flame time and burn length;
- Selected cabin materials that would self-extinguish and release no more than a predetermined amount of heat and smoke; and
- Flammable materials with an acceptable rate of burn.
Therefore, many aircraft materials were certified even though they were either flammable or would burn within established performance criteria.
Many materials are installed in aircraft as part of a system, even though they are normally tested individually for flammability. For example, thermal acoustic insulation materials are typically installed as a system that includes cover material, insulation, and related components, such as splicing tape, fasteners, and breathers. However, by regulation, the testing of the "finished product" only consists of insulation and cover material together. Consequently, the "as-installed" thermal acoustic insulation materials may pose a different propensity to ignite and propagate fire than its testing would reveal.
1.14.2 Review of in-flight fire accident data
A TSB review of data concerning in-flight fires shows that uncontrolled fires similar to that of the occurrence aircraft are rare. The review also indicates that where an in-flight fire had developed and led to a crash, the time from detection until the aircraft crashed ranged between 5 and 35 minutes. This time frame leaves little time available to gain control of the fire. (See Section 126.96.36.199.)
In SR 111, the time between detection of the first odour in the cockpit and when the aircraft struck the water was approximately 21 minutes.
1.14.3 Designated fire zones and smoke/fire detection and suppression
The occurrence aircraft met the regulatory requirements, and was consistent with industry standards for smoke/fire detection and suppression equipment. No regulatory requirement existed for built-in smoke/fire detection or suppression devices in those areas not specified as either a designated or potential fire zone, which are referred to in this report as non-specified fire zones. Non-specified fire zones included areas such as the cockpit, cabin, galleys, electrical and electronic equipment compartment, attic spaces, areas behind side walls, and areas behind electrical panels.
Smoke/fire detection and suppression in non-specified fire zones is dependent on human intervention. However, in the MD-11 and other transport category aircraft, the airflow within the aircraft is such that air moved from some of the inaccessible areas to the occupied areas is first filtered by highly efficient aircraft ventilation and filtering systems that can effectively remove most of the combustion by-products of small fires. Therefore, a fire may ignite and propagate in an inaccessible area and its detection could be delayed.
Designated fire zones were identified as such because they were recognized as having both potential ignition sources and flammable materials. Although flammable materials existed in the non-specified fire zones, the threat of ignition was considered minimal. There was no recognized need to train aircraft crews for firefighting in other than the interior cabin areas, or to design aircraft to allow for quick and easy access to hidden non-specified fire zones for firefighting purposes.
Fire suppression in aircraft cabin areas is largely accomplished with hand-held fire extinguishers, located in such areas as the cockpit and galleys. For small, accessible fires, hand-held fire extinguishers have proven to be adequate. It has not been demonstrated that aircraft crews using hand-held fire extinguishers can be consistently effective in accessing and extinguishing fires in less accessible areas, such as attic areas or avionics compartments, also known as electrical and electronic equipment bays.
1.14.4 Time required to troubleshoot in odour/smoke situations
It can take time for odour or smoke to develop to the concentration necessary for the crew to cognitively establish that they are dealing with an abnormal situation. This can delay the initiation of checklist actions.
When the source of odour/smoke is not readily apparent, flight crews are trained to follow checklist troubleshooting procedures to eliminate the origin of the odour/smoke. Most of these procedures involve removing electrical power or isolating an environmental system. A variable amount of time is required to assess the impact of each action, typically to see whether the odour/smoke dissipates. For some checklists, including the MD-11 checklist, this procedure could take an extended period of time. The longer it takes to complete a prescribed checklist that is designed to de-energize a smoke source, the greater the chance that the smoke source could intensify or become an ignition source and start a fire.
1.14.5 Risk of remaining airborne – Emergency landing
Odour/smoke occurrences rarely develop into uncontrolled in-flight fires. At the time of the SR 111 occurrence, there was a diminished concern within the aviation industry about "minor" odours. There was an experience-based expectation that the source of such odours would be discovered quickly, and that actions could be taken to rapidly eliminate the problem.Footnote 64 In the operating environment at that time, operators did not have policies in place to ensure that flight crews would be expected to treat all odour and smoke events as potential serious fire threats until proven otherwise.
However, when an event that produces odour/smoke evolves into an unsuppressed in-flight fire, there is a limited amount of time to safely land the aircraft. Therefore, the decision to initiate a diversion or emergency descent or both must be made quickly to put the aircraft in a position for an emergency landing if that becomes necessary. Typically, flight crews were not required to immediately initiate a diversion to the nearest suitable airport, or to prepare the aircraft for a landing as soon as possible in the event that the situation evolves into an uncontrollable in-flight fire.
1.14.6 Integrated firefighting measures
At the time of the SR 111 occurrence, the aviation industry had not looked at in-flight firefighting in a systemic way. Typically, aircraft crews were not equipped to recognize and immediately react to signs of a potential in-flight fire. An effective firefighting plan must include procedures that include the optimum involvement of flight and cabin crew to detect, locate, access, assess, and suppress an in-flight fire in a coherent and coordinated manner. When smoke from an unknown source is detected, pilots must take immediate action to prepare for a landing as soon as possible along with other appropriate checklist actions. Such preparations optimally would involve the pilots and underscores the importance of involving other crew members in helping to deal with detection and suppression of the fire or potential fire situation.
In the event that the aircraft is at a geographical location from which a timely landing at a suitable airport is not feasible, pilots must be trained to consider alternatives, such as preparing for a potential forced landing or ditching. In such a circumstance, the capability to locate and extinguish the fire is critical. Typically, aircraft crews are not trained to implement such immediate measures.
1.14.7 Airflow patterns
Airflow patterns in the MD-11 are affected by the aircraft configuration. In the forward portion of the aircraft, this configuration includes the valve position of individual air outlets in the cockpit and throughout the cabin, and the position of the louvres in the bottom part of the cockpit door. Also, all MD-11s are equipped with a smoke barrier installed laterally across the aircraft in the attic area above the cockpit aft wall (see Figure 3). Inspection of Swissair MD-11s showed that the smoke barrier was sealed relatively tightly in some aircraft, while in others there were gaps in the barrier at the edges and at the seams where conditioned air ducts pass through the barrier. These gaps allowed air to flow past the smoke barrier. The holes in the barrier, designed to permit the engine fire shut-off cables to pass through the barrier, would also be a path for smoke to pass between the cabin and cockpit. Additional information on airflow is included in Section 1.16.3.
1.14.8 Describing the SR 111 fire-damaged area
To document and assess the heat and soot patterns created by the in-flight fire, it was necessary to identify and inspect thousands of individual pieces of wreckage and to place many of them into a reconstruction mock-up (see Figure 19). The reconstruction mock-up was designed to conform to the dimensions of the forward section of an MD-11, and comprised the area above the floor line between fuselage STA 275 and STA 595 (approximately 8.23 m (27 feet) in length).
The fire in the occurrence aircraft occurred in an area where the longitudinal (Y) axis, and vertical (Z) axis numbering is positive. The lateral (X) axis numbering is either positive (left side) or negative (right side). For simplicity in this report, the Y-axis positions will be referred to by their STA numbers. (See Section 188.8.131.52 for a description of the aircraft coordinate system.)
1.14.9 Determination of heat damage
To provide a temperature reference to assess the intensity of heat damage caused by the fire, pieces of comparable materials were intentionally exposed, under controlled conditions, to heat at various temperatures for specified time durations. The materials included pieces of the aluminum air conditioning ducts, frames, and intercostals, which were typically covered with green coloured fluid-resistant (FR) primer paint. While heating these materials, it was found that the FR primer paint incrementally changed colour when exposed to increasing temperatures, thereby making it possible to determine the approximate amount of heat exposure experienced by the fire-damaged aircraft pieces. When creating the frame temperature reference exemplar coupons, it was found that by elevating the temperature to a range of between 482°C to 593°C (900°F to 1 100°F) for 10 minutes, the FR primer paint would disappear from the surface of the exemplar piece, leaving bare metal. The temperatures shown in the figures within this report display either the temperature value of a particular representative coupon or the average value of a range of temperatures in instances where more than one coupon applies. These coupons were made based on a 10-minute exposure at a constant temperature. It is possible that exposure to higher temperatures, over a shorter time duration, may have created similar heat-damage patterns to those observed on the wreckage.
Pieces of non-metallic material, including wire insulation and electrical module blocks, were also exposed to heat under controlled conditions to produce exemplar coupons that enabled an assessment of temperatures reached by like materials from the aircraft wreckage.
The most severe heat damage to metal aircraft structure was identified by the presence in a few areas of resolidified aluminum metal that had once been molten or near-molten. The forces of impact on aluminum in a molten or near-molten state can create a signature, referred to as "broomstraw," at the edges of a fracture. High heat can also create a distinctive, layered, feather-like appearance at the edges of a fracture, referred to as "feathered edge."
By identifying and placing the various wreckage pieces into the reconstruction mock-up, it was possible to assess heat damage and soot patterns in an attempt to determine the origin of the fire and how it propagated. The heat and soot distribution information, together with other data such as the type, amount, and location of combustible materials, was entered into computer models so that the information could be integrated and the patterns more readily viewed and assessed.
Damage patterns indicate that the fire was concentrated in the areas above the cockpit ceiling liner and above the forward cabin drop-ceiling. Reconstruction of the wreckage disclosed significant heat damage on portions of the airframe structure and air conditioning system ducts in these areas, extending from approximately STA 338 to STA 675. Most of the heat damage in the cockpit was concentrated above the level of the bottom of the upper avionics CB panel (Z= 59) and in the area of the forward cabin drop-ceiling above Z= 61. The farthest forward deposits of significant soot in the cockpit were found on the standby compass near STA 313. The farthest aft soot deposits were found on an overhead stowage bin located near STA 1780.
1.14.10 Assessment of fire damage
184.108.40.206 Aircraft skin panels
The construction of the upper crown of the aircraft consisted primarily of 2024 aluminum alloy stressed skin exterior panels, rivetted to 7075 aluminum alloy airframe structure. The aircraft skin was painted on the outside with white exterior paint and painted on the inside with green FR primer.
There was no indication that the fire burned through the aircraft skin at any place along the fuselage, nor was there any indication of discolouration of the white exterior paint. There were varying degrees of soot accumulation on the interior surface of some of the aircraft skin panels in the area of the fire.
Forward of STA 475, insulation blankets were placed directly against the aircraft skin between the frame structure. A layer of over-frame insulation blankets was then added to cover the entire area. Between STA 475 and STA 755, no between-frame insulation blankets were installed, only the over-frame insulation blankets.
In some areas of fire damage, the lack of soot accumulation on the aircraft skin panels suggests that the insulation protected them from the fire, particularly where double layers of insulation blankets were installed. In those areas, it appeared that the between-frame insulation blankets remained in place until the aircraft struck the water.
There were two areas of predominately heavy soot accumulation on the aircraft skin, located between STA 401 and STA 420 from X= 25 to X= −25, and between STA 475 and STA 555 from X= 35 to X= −50. Between these two areas, from STA 420 to STA 475 located between X= 40 and X= −30, there was an area that had a mixture of light to moderate soot accumulation. This area is within the area above the forward passenger entry door tracks and operating cables. Another area of moderate soot accumulation was located from STA 374 to STA 401 between X= 45 to X= −25. Outside of these areas, the amount of soot on the recovered skin portions ranged from light to none.
220.127.116.11 Forward Airframe Structure Condition
Most of the airframe structural components were painted with green FR primer prior to their assembly, and were covered with insulation blankets during the aircraft construction (see Figure 4). For the inner surfaces of the frames and intercostals to become exposed to either soot or heat damage, the insulation blankets must first be compromised.
Material heat testing showed that a 10-minute exposure to temperatures below 204°C (400°F) did not discolour the FR primer; therefore, recovered structure with no discolouration of the FR primer was useful in establishing the boundary between heat-damaged and non-heat-damaged areas.
The airframe structure in the cockpit attic area with the most heat damage was forward of STA 366 between intercostal planes 15 left and 15 right (see Figure 24 and Figure 25). The intercostals appear to have created a barrier that, for the most part, impeded the fire from spreading in an outboard/downward direction. On the left side, heat damage extended outboard of intercostal plane 15, on the STA 366 frame, for approximately 10 to 15 cm (4 to 6 inches). On the right side, heat damage extended outboard of intercostal plane 15 on frame planes 10, 11, and 12 for approximately 30 cm (12 inches). This area is directly behind, and above, the upper avionics CB panel.
Between STA 366 and STA 401, the most significant heat damage pattern was along the crown of the aircraft between the plane 15 left and right intercostals. The severity of the heat damage increased toward STA 401. This area is above the cockpit centre overhead air diffuser, and immediately aft of the cockpit door.
The most forward airframe structure with heat damage resulting in bare metal was at STA 353 at X= −20, and the most rearward was on the STA 535 frame between X= 31 and X= −48. Between these two station locations, there were 17 additional frames or intercostals with similar patterns of heat damage.
The most forward area with feathered-edge damage was the STA 374 frame between X= 17 and X= −9, and the most rearward was at the STA 515 frame between X= −15 and X= −22. In the area between these two frames, 17 additional frames or intercostals showed feathered-edge damage.
Mechanical fractures with broomstraw-like appearance were found at 16 separate locations on frames and intercostals between frame STA 374 and frame STA 466. Broomstraw was also noted on the R1 passenger door forward track at approximately STA 427 between X= −29 and X= −31.
18.104.22.168 Air distribution system–Cockpit and cabin
The area of the fire damage above the ceiling in the front of the aircraft contained a network of primarily aluminum air ducts that were part of the aircraft's air distribution system (see Figure 3, Figure 8, Figure 24, Figure 26, and Figure 27). The ducts from this area were reconstructed from small pieces that were straightened, identified, fracture matched and sewn together with locking wire to replicate their original shape. Most of the aluminum ducts in the fire-damaged area were painted with FR primer prior to installation. In service, they were wrapped with thermal acoustic insulation blankets. The rebuilt air ducts provided information about the boundaries of the fire and the intensity of the heat.
Heat damage to the ducts that provided air to the cockpit ranged from no damage to heat damage resulting in bare metal. There was bare-metal heat damage starting near the top of Galley 1 and running forward to the cockpit manifold. A portion of a duct located above the cockpit door at approximately STA 396, X= 19 and Z= 72 had several resolidified aluminium deposits on the outer surface. The precise alloy of this aluminum could not be determined.
There was bare-metal heat damage on the ducts behind the cockpit air diffusers from STA 350 aft to STA 402, primarily between the plane 15 left and right intercostals. The exception was the window diffuser distribution duct, which had bare-metal heat damage along STA 392 to X= 32. The heat damage to the recovered portions of the diffusers varied, with higher heat on the upper surfaces and lower heat on the lower surfaces adjacent to the cockpit ceiling liner.
Damage to the riser duct assembly ranged from no heat damage to bare-metal heat damage. The vertical portion of this assembly had no heat damage. The first area of bare-metal damage to the riser duct assembly started at intercostal plane 15 right, where the lower surface had a region of bare-metal heat damage from X= −30 inboard to the joint at X= −20. This was in the vicinity of the Galley 2 vent end cap. There was bare-metal damage from approximately STA 395 to STA 442 between X= 25 and X= −10. A section of molded duct was installed in that area from STA 420 to STA 442 between X= 5 and X= 25. No portions of this molded duct were identified in the wreckage.
Between approximately STA 480 and STA 545, the main conditioned air ducts for zones 2, 3, and 4 transitioned from running near the top of the forward cabin drop-ceiling, upward to run near the crown of the aircraft. In this area there was bare-metal heat damage at places along the top of the ducts. The primer on the underside of these ducts was not damaged by heat. The recovered portions of two individual air ducts from approximately STA 555 to STA 595 at X= 70 and X= −70 had areas of light to moderate soot accumulation.
22.214.171.124 Air recirculation system
Recirculation air was supplied by four fans located above the passenger compartment ceiling at STAs 685, 725, 1009, and 1109 at X= 28 (see Figure 24). Each fan drew air through a filter and plenum assembly located at the corresponding station from X= 40 to X= 65. The plenum assemblies, which had been painted with FR primer on their aluminum parts, were reconstructed.
The plenums at STA 685 and STA 725 had no discolouration of the FR primer. They did have localized areas with heavy soot accumulation. The recovered portions of the fibreglass filter elements had dark grey colouration on one side and light grey colouration on the opposite side. The hoses connecting these plenum assemblies to the fan housings had localized light soot accumulation on the outer surfaces but had no soot accumulation on the interior surfaces. The recovered portions of the plenums at STA 1009 and STA 1109 had no heat damage or soot accumulation.
The recirculation duct was uninsulated between STA 569 and the recirculation fan. A check valve was installed in the duct to prevent reverse airflow when the fan was not operating. The reconstructed recirculation duct portions had been installed between the STA 685 fan and the cabin conditioned air duct, just forward of the muffler, at approximately STA 555. The duct had bare-metal heat damage on the uninsulated sections aft of STA 569.
The individual air supply to the centre section of the forward cabin was provided by two ducts, which were connected to a recirculation air duct at STA 575, X= 29 and STA 672, X= 24. Both individual air supply ducts showed bare-metal heat damage.
126.96.36.199 Left and right forward passenger cabin individual air
Forward passenger cabin individual air was supplied by a fan and plenum assembly identical to a recirculation air fan and plenum assembly. The fan was located at STA 990 at X= −24. The plenum assembly was between X= −40 and X= −65. The recovered portions of the plenum had no heat damage or soot accumulation. The individual air ducts were uninsulated and ran forward from STA 990 to a "Y" (split) at STA 750 at Z= 91, X= −21. One branch of the "Y" ran across the crown to the left side of the cabin at X= 76, and the other ran to the right side at X= −76. The recovered portions of these ducts had moderate to heavy soot accumulations on the exterior, with no heat damage. The aftermost section of individual air duct that was identified was from STA 934 to STA 955 at X= −22 and had light soot accumulation on the exterior.
188.8.131.52 Forward galleys
Galleys 1, 2, and 3 were installed forward of the first-class cabin. The outer surfaces of the top of these galleys were exposed to the forward cabin drop-ceiling area through a cut-out in the ceiling panels. Identified portions of these galleys were reconstructed to examine their exposure to the fire environment.
Galley 1, which was installed on the left side of the cabin between the cockpit aft wall and the L1 door, had heavy soot accumulation and heat damage on the top outer surface (see Figure 27). Other components of Galley 1 had varying degrees of soot accumulation, particularly near the top of the unit where it had been exposed to the fire environment. The electrical equipment in the forward upper compartment of Galley 1 did not show any fire or soot damage. Wires installed inside the galley were not affected by the fire. A four-wire harness, which was routed through an access hole in the top of the galley, had a length of white spiral wrap that had localized soot accumulation. The wires in the harness had localized light-brown discolouration.
Galley 2 was installed on the right side of the cabin between the cockpit aft wall and the R1 door. No pieces of the outer surface of the top of this galley were identified. Pieces of Galley 2 from below the forward cabin drop-ceiling were identified and did not show heat damage or soot accumulation.
Galley 3 was installed in the forward-centre position in the aircraft, immediately aft of the L1 and R1 doors between STA 470 and STA 508. There were localized areas of light soot on pieces of Galley 3 on or near the top of the unit. The portions of the wires that were installed on the upper surface of the galley top showed some soot accumulation, whereas those wires installed within the galley were free of soot. Wires associated with the Galley 3 disconnect assembly had soot accumulation ranging from trace to heavy, and showed areas of heat damage.
184.108.40.206.1 Forward galley vent system
The forward galley vent duct assembly comprised a single, uninsulated aluminum duct with branch connections to the three forward galleys (see Figure 3 and Figure 8). The upstream end of the vent duct was located above the forward cabin drop-ceiling above Galley 3. The duct ran horizontally forward above the conditioned air ducts to Galley 2, and continued laterally across the fuselage to a point above the top of Galley 1. The vent duct then ran vertically down the left side of the fuselage, outboard of Galley 1, to an area below the cabin floor. The duct continued aft under the cabin floor along the left side of the aircraft ending at the cabin air outflow valve located just forward of the left wing root. The forward galley vent system utilized a pneumatic jet pump operated by bleed air from the Pneumatic System 1. The jet pump was installed at approximately STA 872 to provide a single source of constant vacuum for the forward galleys, both in flight and on the ground. This installation provided a constant flow of between 200 and 400 CFM at the jet pump that was exhausted overboard through the outflow valve at STA 920.
From the upstream end of the forward galley vent duct, a branch duct extended vertically down to connect with the air intake grill near the top of Galley 3. A similar vertical branch extended from the vent duct toward the top of Galley 2; however, this branch was not connected to Galley 2 and the branch was closed off with a silicone elastomeric end cap (see Figure 4 and Figure 6). The vent connection to Galley 2 was not made because Galley 2 was not electrically powered, nor was an oven installed.Footnote 65 A ceiling-mounted air intake plenum was installed in the corridor outside the cockpit door, near the inboard edge of Galley 1. The air intake plenum was connected to the forward galley vent duct by a 8-cm (3-inch) diameter hose that was routed across the Galley 1 ceiling. This hose connected to the vertical portion of the forward galley vent duct between the left fuselage and the outboard face of Galley 1. A second hose, measuring 5 cm (2 inches) in diameter, extended from the outboard face of Galley 1 and connected to the vertical portion of the galley vent duct at STA 398, X= 48, Z= 60, just below the 8-cm (3-inch) hose. This second hose drew air (odours) from Galley 1 into the vent duct.
Two segments of the forward galley vent duct were identified; both were located on the vertical section of the vent duct that was routed between the left fuselage and the outboard face of Galley 1. The first segment was located at the cabin floor level (Z= −18); the second segment was located below the point where the 8- and 5-cm (3- and 2-inch) diameter hoses connected to the vent duct (Z= 11 to Z= 42). Both of the above-floor duct segments sustained high heat damage. Identified portions of the galley vent system from below the cabin floor, between STA 396 and STA 457, exhibited localized areas of moderate heat damage. Identified portions of the vent duct, located below the floor and aft of STA 457, exhibited no heat damage.
220.127.116.11 Forward lavatories
The Lavatory A module was installed on the left side of the aircraft forward cabin between approximately STA 465 and STA 495, immediately aft of the L1 door. A portion of the top of Lavatory A was recovered with a wire harness still attached (see Figure 27). Localized soot accumulations were noted on both the attic and cabin facing surfaces of the portions recovered. The attached wire harness was also sooted. Few additional pieces of this lavatory module were recovered and identified. Of those that were identified, there were no signs of heat damage.
The Lavatory B module was installed on the right side of the aircraft forward cabin between approximately STA 460 and STA 496, immediately aft of the R1 door. Only three pieces of this lavatory module were identified. There was soot accumulation on the cabin-facing side of these pieces, which were from the upper portion of the module. There was soot accumulation on the Lavatory B cabin placard.
There were no signs of heat damage or arcing on any of the wires associated with the forward lavatories. Light soot accumulation was noted on some of the wiring. The smoke detector control panel for these two lavatories, which was located above the forward cabin drop-ceiling over Galley 1, showed soot accumulation and heat damage.
There is no indication that either smoke alarm activated before the recorders stopped. The available information indicates that the fire did not start within one of the forward lavatories.
18.104.22.168 Cockpit and passenger cabin material
Materials from within the passenger cabin were examined for fire-related damage. One business-class seat cushion assembly, complete with seat cover, had several locations where melt-like features and discolouration were evident, consistent with the drop-down of hot materials. None of the melt-like features appeared to penetrate the underlying cushion. Sections from some fabric curtains used in the cabin had damage consistent with being exposed to heat, including discolouration, and stiffness or roughness or both. There were also areas where melted and resolidified material was adhering to the curtain fabric, including an MPET-covered insulation blanket, a blue-green material consistent with being from an electrical module block, and a material consistent with 7075 aluminum alloy. These curtains were most likely located in the aisle between lavatories A and B, and Galley 3.
Complete passenger comfort blankets and portions of these blankets were recovered. When not in use, these blankets are stored in overhead bins in the passenger cabin. Some blanket material had minor heat-related damage.
Areas of forward galley flooring and forward cabin carpet near the forward lavatories had localized areas of heat damage consistent with the drop-down of hot materials. A tiny portion of aluminum alloy that appeared to have melted and resolidified was found in a piece of forward galley flooring that had been installed along a wall. The exact type of alloy could not be identified.
One portion of cabin carpet had an area of numerous small holes through the carpet pile and backing, which were consistent with having been caused by drop-down of hot materials. This area was from approximately STA 472 to STA 505, between X= −26 and X= −46, with the highest concentration from approximately STA 482 to STA 493. This corresponds to the aisle area between Galley 3 and Lavatory B.
In the cockpit, there were numerous locations where localized heat damage had taken place. Microscopic fibre analysis confirmed that the spotted areas had been generated by fire drop-down damage. Attempts to recover traces of the drop-down material to identify it were unsuccessful, as it appears they were dislodged at the time of impact. The source for a large extent of the fire drop-down damage was most likely the cockpit ceiling liner melting and dropping down onto the carpet (see Section 22.214.171.124).
Several deposits were found on the right observer seat. Small amounts of resolidified 2024 aluminum alloy were deposited on the lap belt, and on the right side of the seat. When the resolidified metal was removed from the lap belt for analysis, a white deposit remained. Other white deposits were observed elsewhere on the same lap belt. Trace analysis of these deposits disclosed that they were primarily aluminum oxide, and microscopic fibre analysis revealed fused heat damage material at each location. The white deposits were determined to be the remnants of other locations where resolidified aluminum had also been deposited. It was not possible to determine the alloy of the aluminum from the remnants. A small amount of resolidified 6061 aluminium alloy was found on the rear of the right observer seat base.
Two cockpit checklist booklets were recovered with the aircraft wreckage. Both were heat damaged. In these checklists, each double-sided page is contained in a plastic sleeve, and the pages are bound together along one edge. Each sleeve can be rotated about its bound edge and turned over and under the booklet so that one page is visible on one side of the booklet and the next page in the sequence is visible on the other side of the booklet.
One of the booklets had more heat-related damage than the other. Some of the edges of the plastic sleeves had been partially melted and fused together, fixing the booklet in the open position to pages 10 and 11. Page 10 was the Smoke/Fumes of Unknown Origin checklist, and Page 11 was the Smoke/Fumes Removal checklist. Page 11 was more significantly heat damaged than Page 10. The heat pattern appeared to be from the outside surface inward, suggesting the booklet was in a horizontal position with Page 11 upward at the time it was heated. On the second checklist booklet, a small burn mark was found at the top edge of Page 1 (Index) and extended through to Page 4 (ENG 2 A-ICE DUCT). Two mating heat-related damage marks were found on Page 2 (INTENTIONALLY LEFT BLANK) and on Page 3 (ENGINE–FIRE).
126.96.36.199 Cabin ceiling panels
Ceiling panels were used to separate the passenger space from the attic area throughout the cabin portion of the aircraft. The panels were suspended from the structure of the aircraft fuselage using suspension rods, beams, and attachment hardware. All the panels were manufactured as phenolic/glass skins, bonded to meta-aramid fibre paper honeycomb-like core. Some of the panels had white bondable PVF adhered to one side only and some showed it on both sides. A decorative PVF laminate was adhered to the face of the panels that were visible from the passenger compartment.
Three types of ceiling panels were used to construct the passenger cabin ceiling and another four types were used to construct the forward cabin drop-ceiling. Of these four, the CD 207 type panel was used to construct portions of the overhead bins and the two sliding ceiling panel assemblies at the forward doors. Similar types of panel construction were used to fabricate the close-out panels, forward cabin drop-ceiling, header panels and bridge/gap assembly panels.
Portions of the various panels were recovered and examined for soot and heat damage. As ceiling panels had been fractured into many pieces by impact forces, their installed locations in the aircraft could not be positively identified. Of the recovered pieces, many showed signs of heat damage or soot accumulation or both. The heat damage varied from discolouration to severe charring of the panel core. Most of the heat damage was on the attic side of the panels but some displayed heat damage on the cabin side as well. This could be considered an indication that the fire had penetrated the ceiling in these areas.
Some of the panels could be identified as to type by their construction. One piece of CD 207 panel was determined to be either a portion from one of the sliding forward door panel assemblies in the forward cabin drop-ceiling area or a panel portion from one of the overhead stowage bins in the first-class cabin. The damage to this piece was consistent with exposure to a temperature of 593°C (1 100°F) for 10 minutes. Four recovered pieces were identified as portions of bridge/gap cover assemblies in which the aisle and emergency lights were installed. These portions had areas of dark-brown discolouration in the shape of a half moon, which coincided with the installation location of the aisle and emergency lights. Another four of the recovered pieces were determined to be portions of the overhead stowage bins. Three of these portions showed no indication of heat damage. The fourth portion, identified as part of an overhead stowage bin ramp air duct, showed a soot pattern similar to that deposited on an adjacent panel.
188.8.131.52 Cockpit ceiling liner and dome light
Cockpit ceiling liners, constructed of a light grey thermoformableFootnote 66 low-heat-release sheet material, are installed as the interior finish surface of the flight compartment. The material has a low forming temperature; that is, it melts within a relatively low temperature range. It begins to soften and sag at 246°C to 274°C (475°F to 525°F). The five sections that comprise the cockpit ceiling liner are attached to the aircraft structure with screws and nutplates.
The overhead liner is installed immediately aft of the overhead CB panel (see Figure 9 and Figure 10). The liner includes the cockpit dome light assembly and has openings for the air conditioning system diffusers and diffuser controls. Some of the dome light components displayed light soot deposits; the identified portions of the dome light assembly showed a few signs of heat damage. Only a small number of pieces of the centre overhead liner were identified. Heat damage on the fuselage-facing surface of the pieces was indicated by a dark brown to black discolouration. The cockpit-facing surface of the pieces had localized heat damage indicated by hints of taupe discoloration. The heat also caused thinning, necking, surface melting, and wrinkling of the material. The surfaces showed localized light to moderate soot, wrinkles, bubbles, and edge melting.
The left and centre-left liners enclose the area bound by the left edge of the overhead switch panel housing, aft to the ceiling panel and then bordered the dome light and left diffuser outlet aft to the cockpit coat closet. The lower edge of the liners follow the top of the clearview and aft windows back to the cockpit coat closet. The left liner has cut-outs to accommodate two air conditioning slide controls, individual air supply, captain's map light and speaker control box, observer's map light and on/off dimmer control, audio and microphone jack panels and three inspection panels. The cut-out for the captain's map light and speaker control box is located in the forward lower corner of the left liner. The left liner also incorporates an escape rope compartment door, located adjacent to the captain's air conditioning slide control. The centre-left liner has cut-outs for the spare lamps compartment door and an individual air supply.
The majority of the left liner was identified and reconstructed. The fuselage-facing surface of the liner had heavy soot deposits over most of the surface, along with heat damage. The heat damage varied from dark brown to black discolouration with localized small wrinkles and surface melting. The cockpit-facing surface had moderate to heavy soot deposits from the forward to the aft end of the liner, with localized areas exhibiting surface wrinkles caused by heat. The microphone/headset hook, located approximately one third of the way from the front of the liner, displayed moderate soot accumulation on the surface. A piece of the escape rope compartment door had no heat damage. The only piece of the centre-left liner that was identified was a small portion of the spare lamps compartment door that had remained attached to its hinge assembly. The cockpit-facing surface had melting and bubbling with dark brown and black discolouration. The surface that faced into the Spare Lamps compartment had localized light soot deposits.
The right and right aft liners enclose the area between the right edge of the overhead switch panel housing, the upper avionics CB panel, lower avionics CB panel, and the cockpit video monitor. The lower edge of the liners follow the top of the clearview and aft windows back to the video monitor. The right liner has cut-outs to accommodate the air conditioning slide control, individual air supply, first officer's map light and speaker control box and, audio and microphone jack panel. The cut-out for the first officer's map light and speaker control box is located in the forward lower corner of the right liner. The right liner also incorporates an escape rope compartment door, located adjacent to the first officer's air conditioning slide control.
The majority of the right and right aft liners were identified and reconstructed. The fuselage-facing surface of the right liner had light accumulations of soot, along with several areas of heat damage. The heat damage varied from light to dark-brown discolouration near the microphone hook, to black discolouration with blisters and surface melting near the overhead CB panel. The cockpit-facing surface had localized areas of light soot accumulation. The heat discolouration varied from dark grey, to dark grey with light taupe in localized areas. There was slight blistering of the surface. The right aft liner displayed light soot only, with no heat damage.
184.108.40.206 Avionics circuit breaker panel
The avionics CB panel consisted of upper and lower panels, located above the work table at the right observer's station (see Figure 12). The main body of each panel was constructed of aluminum. The upper avionics CB panel had five rows of CBs, identified alphabetically from A to E. Individual CBs were numbered sequentially, starting from the left, and were identified according to the row in which they were installed (e.g., CB D1). The lower avionics CB panel had one row of CBs, identified as Row F. The front (inboard) face of both the upper and lower avionics CB panels was painted grey, and the back (outboard) face was not painted.
About 75 per cent of the upper and lower CB panels were identified, reconstructed, and placed in the reconstruction mock-up (see Figure 27 and Figure 28). The most forward sections of the upper and lower CB panels were not recovered. The upper avionics CB panel had been exposed to heat coming from both the front and back sides. The lower CB panel did not show any heat damage. The heat damage pattern on the front face of the upper CB panel was shown by the change in colour of the paint. Parts of the panel displayed damage consistent with temperature reference exemplar coupons exposed to temperatures from 430°C to 620°C (800°F to 1 150°F) for 10 minutes.Footnote 67 Discolouration and heat damage was present on the back side of this panel on some electrical components and on some bare-metal surfaces. Although there were similarities at some locations, the damage pattern on the back side was less than on the front side, particularly on those pieces near the forward end of the panel where the front side of the panel showed considerably more heat damage than the back side. Individual CBs showed soot on the white indicator ring; soot could only have been deposited if the CB had tripped and subsequently been exposed to combustion by-products. Details concerning the CBs on the avionics CB panel and wiring in the vicinity are included in separate sections of this report.
It was noted that the heat damage on parts of the upper avionics CB panel was consistent with damage seen on temperature reference coupons that were exposed to temperatures from 427°C to 620°C (800°F to 1 150°F) for 10 minutes.Footnote 68
220.127.116.11 Overhead circuit breaker panel
The overhead CB panel is located just aft of the overhead switch panel in the cockpit ceiling, above and behind the captain's and first officer's seats (see Figure 12). The panel has seven rows of CBs identified alphabetically from A to G. Like the avionics CB panel, individual CBs are numbered sequentially, starting from the left, and are identified according to the row in which they were installed (e.g., CB A1). An integrally illuminated, polycarbonate lightplate base assembly was installed on each row of CBs.
Most of the CB panel was identified, reconstructed, and placed in the reconstruction mock-up (see Figure 27 and Figure 29). On the cockpit-facing surface, approximately two thirds of the polycarbonate lightplate base on Row A had been melted and folded back over onto itself, forming a fused mass of material near the top right corner of the panel. Part of the right end of the lightplate base on Row B was also melted and fused into this mass. The top right corner of the panel where the paint was missing had heat damage consistent with temperature reference coupons that were exposed to temperatures from 427°C to 621°C (800°F to 1 150°F) for 10 minutes, and the area where the paint was discoloured had heat damage consistent with temperature reference coupons that were exposed to temperatures from 343°C to 398°C (650°F to 750°F) for 10 minutes. The rear surface of the panel also showed signs of localized high-heat damage at the top right corner.
Individual CBs showed soot on the white indicator ring. Soot could have been deposited if the CB had tripped and subsequently been exposed to the smoke environment.
18.104.22.168 Heat and fire damage pattern–Aircraft wires and cables
All of the wire segments identified as being from the heat-damaged section of the aircraft were compared to exemplar wires before being incorporated into the reconstruction mock-up. The exemplar wires were created by heating them at specific temperatures for specific times in a controlled heat environment. When the exemplar wires were heated, it was observed that the ETFE wires were more susceptible to heat than the polyimide wires. This was consistent with the damage observed on the wire segments that were recovered. The examination of the wire segments from the heat-damaged area helped define the heat pattern and boundaries of the fire. There were wires from the area of the fire that had no discernible damage. There was a range of damage on other wires, from light soot, to complete melting and destruction of the wire insulation.
The wires that were routed between the upper avionics CB panel and the avionics disconnect panel had areas of localized soot accumulation, and some minor heat damage. The bus feed wires that were routed between the upper avionics CB panel and the upper main CB panel had some areas of localized light soot accumulation, and some minor heat damage, near the upper avionics CB panel. The ETFE wiring that was routed above this area, closer to the aircraft structure, showed more pronounced heat damage.
The IFEN-related PTFE 8 AWG jumper wires from the forward end of the lower avionics CB panel were not heat damaged. Polyimide wires in the same area near the lower avionics CB panel showed soot accumulation, but no heat damage. Based on the appearance of the surrounding area, it was considered likely that the IFEN-related 8 AWG and 12 AWG wires that were routed from the aft end of the lower avionics CB panel upward toward the bottom of the avionics disconnect panel had little heat damage. The portions of these wires that were located near the ceiling structure area, including where the 12 AWG IFEN wires entered the conduit, were heat damaged.
1.14.11 Potential ignition sources
The wreckage reconstruction mock-up helped delineate the boundaries of the fire damage, which were primarily located in the cockpit attic and forward cabin drop-ceiling areas. Within the primary fire-damaged area, the most prevalent potential ignition source was electrical energy. Numerous power cables and wires were present in this area, running to or from either the avionics compartment, the cockpit CB panels, or the overhead switch panels. There were also numerous other electrical components, such as module blocks, ground studs, light fixtures, battery packs, two electrically powered galleys, two lavatories, and electrically powered door mechanisms. Consideration was given to other ignition mechanisms, such as chemical reactions, thermal processes (e.g., conduction, convection, radiation) and mechanical operations (e.g., friction) but none were found. Only those related to electrical energy were assessed as being pertinent.
Each of the 20 wire or cable segments exhibiting arc damage was assessed for potential involvement as an ignition source. Several criteria were taken into account when making this assessment, such as information from the CVR about the cockpit and passenger cabin environment, the time frame between when the odour was first noted and when the fire first affected aircraft systems, the presence and proximity and quantity of flammable materials, the fire damage pattern, and the airflow patterns in the aircraft as determined through flight testing and research.
The initial odour and smoke were noticed only in the cockpit, and the pilots assessed it to be from an air conditioning source. The actions by the pilots, and the airflow patterns in the cockpit area, suggest that the smoke was most evident at or near the cockpit rear wall. (For additional airflow information, see Section 1.16.3.)
22.214.171.124 Positioning of the IFEN power supply cable segments exhibiting arcing events
When the four IFEN PSU cable segments that exhibited melted copper were positioned parallel to one another, similarities were noticed that suggested that there were two matching pairs of cable segments (see Figure 22 and Section 126.96.36.199). Exhibits 1-3791 and 1-3793 were almost identical in length and colouration, as were 1-3790 and 1-3792.
Once the two pairs were matched together, there were notable differences that distinguished one pair from the other. The 1-3790/1-3792 cable pair was about 18 cm (7 inches) shorter than the 1-3791/1-3793 pair, and starting at about 61 cm (24 inches) from the straightened-out end the 1-3790/1-3792 pair had an almost identical span of approximately 30 cm (12 inches) where the tin coating was completely missing. Over the last 5 cm (2 inches), the tin was again present. The 30-cm (12-inch) region of missing tin was the result of exposure to a localized temperature that was higher than the temperature experienced in the area where the tin remained intact.
Exhibit 1-3790 had copper melt on a single wire 11 cm (4.3 inches) from its end, and additional copper melt on all three wires between 62 and 77 cm (24.3 and 30.5 inches) from their respective ends. Exhibit 1-3792 had copper melt on one wire at 22 cm (8.8 inches), and on a second wire at two locations: 22.6 cm (8.9 inches) and 23.4 cm (9.2 inches) from its end position. The second wire was severed between the two copper melts.
Cable 1-3791 had copper melt on one wire 9 cm (3.7 inches) from its end and at the 62-cm (24.5-inch) location. A second wire also had a copper melt at the 65-cm (25.8-inch) location. Cable 1-3793 exhibited melted copper on one single wire between 64 to 67 cm (25 to 26.5 inches) from its end.
The two pairs of cable segments could not be co-located by aligning all of them to either one end or the other, because the region of missing tin on the 1-3790/1-3792 pair was not duplicated on the 1-3791/1-3793 pair. As the cables had been installed as a contiguous bundle, it is not possible for only two of the four cables to be affected by a localized higher temperature.
Based on the presence of FEP remnants trapped in the wire strands, the PSU cable pairs were considered to have been either in, or in close proximity to, the conduit located above Galley 2. The recovered segments of wire runs FBC and FDC, which had been routed parallel to the conduit in the area over Galley 2, were positively relocated in the aircraft based on the installed position of the marriage clamp at approximately STA 427. It was noted that from approximately 30 cm (12 inches) aft and forward of the clamp along the FDC wire run, and for approximately 30 cm (12 inches) forward of the clamp along the FBC wire run, there was a region that appeared to have been subjected to a higher temperature than the remaining wires in the harness, similar to the region of missing tin on the 1-3790/1-3792 pair of cables. On both sides of the dual clamp, the polyimide film insulation remaining on the FBC and FDC wires was blackened, similar to test samples that had been exposed to a temperature of about 500°C (932°F) for 10 minutes.
A 38-cm (15-inch) segment of IFEN PSU cable with a 30-cm (12-inch) section of tin missing from all three wires was recovered and designated as Exhibit 1-4687. This cable segment was considered to have been from the area near the FBC/FDC clamp, and to be a continuation of either Exhibit 1-3791 or 1-3793. The location on Exhibit 1-4687, where there was a transition between tin and missing tin, was aligned at the aft end of the conduit such that it matched the start of the missing tin on the 1-3790/1-3792 pair. When the three cables were placed with their regions of missing tin aligned, it was noted that the individual wires within the region of missing tin were similarly embrittled. Furthermore, two of the cable segments, exhibits 1-3790 and 1-4687, had nearly identical twists in individual wires that were adjacent to each other in this alignment. The frayed (aft) end of Exhibit 1-3791 closely matched in colour the end of Exhibit 1-4687 where the tin was not missing. The lengths of the fractured ends were of similar lengths, suggesting that they could have been joined at one time. Based on this similarity, Exhibit 1-4687 was considered to be a continuation of Exhibit 1-3791. When the area of missing tin on the 1-3790/1-3792 pair and 1-4687 was aligned on either side of the clamp, and taking into account the known routing of the cables as they exited the conduit, the beginning of the missing tin was placed at approximately the aft end of either the middle or outboard conduit, or possibly just inside the conduit by less than 2.5 cm (1 inch).
Aligning the cables in the outboard conduit using the same criteria as above for placing the region of missing tin placed the single arc on 1-3790 near STA 410 and the remaining (aft) melted copper locations on all three wires from Exhibit 1-3790 approximately 25 cm (10 inches) along the wires aft of STA 420. This placed the copper melts on two of the wires from Exhibit 1-3791 adjacent to the copper melts on the single wire of Exhibit 1-3793 near STA 401. This also located the single copper melt on the forward end of Exhibit 1-3791 approximately 8 cm (3 inches) along the wire forward of the bracket at STA 383. This configuration is shown in Figure 30.
Aligning the cables in the middle conduit, the single (forward) melted copper on Exhibit 1-3790 was located near STA 407 inside the conduit, and the remaining (aft) melted copper locations on all three wires from Exhibit 1-3790 were about 7.5 cm (3 inches) outside the aft end of the conduit. In this configuration, the remaining areas of melted copper on Exhibit 1-3792 were in the conduit between STA 407 and STA 408. In this alignment, it placed the forward end of the 1-3791/1-3793 cables approximately 25 cm (10 inches) along the wire path past the bracket at STA 383. This placed the copper melts on two of the wires from Exhibit 1-3791 adjacent to the copper melts on the single wire of Exhibit 1-3793 near STA 398. This also located the single copper melt on the forward end of Exhibit 1-3791 approximately 15 cm (6 inches) along the wire path outside of the forward end of the conduit. This configuration is shown in Figure 31.
The arced ends of the four 16 AWG control wires (1-3788, 1-3794, 1-3795, and 1-10503) could have been the result of two arcing events severing the wires. The arced ends of exhibits 1-3795 and 1-10503 were a possible match, based on the similarity of the missing tin over a short distance from each of their arced ends. Assuming the arced ends of 1-3788 and 1-10503 were also a match, and laying out the four segments as one continuous wire, their overall length was within a few centimetres of that of the 12 AWG 1-3790/1-3792 pair. Laying the combined 16 AWG control wire alongside the 1-3790/1-3792 pair also showed that their arc locations could be co-aligned, indicating they may have been caused at the same time. However, Exhibit 1-3795 was not missing tin over the same length as the 1-3790/1-3792 pair; this made it less likely that they could be co-aligned.
The regions of melted copper on the 1-3791/1-3793 pair were co-located, suggesting that the arcing events that produced the copper melts occurred at approximately the same time, or within seconds of each other. All of these arcs occurred where the cables would have been running through the conduit, suggesting phase-to-phase arcing occurred when the fire destroyed the conduit and wire insulation.
The one anomaly is the copper melt on a single wire near the forward end of Exhibit 1-3791. This same wire also exhibited melted copper approximately 51 cm (20 inches) further aft, within the conduit. The melted copper in two locations indicates that one of the arcing events did not trip the associated CB. The arcing events in the conduit had the appearance of being more severe, and it is believed that they would have tripped the CB. Therefore, the forward arc event on Exhibit 1-3791 must have occurred first, as electrical power would not be available to produce the forward arcing if the arcing in the conduit had occurred first and tripped the CB.
The melted copper on the 1-3790/1-3792 pair within the conduit also appears to be the result of the fire destroying the conduit and wire insulation. This allowed arcing to take place between phases, and also with the 16 AWG control wire. In the placement of the 1-3790/1-3792 pair, as described above, the single (forward) arc on Exhibit 1-3790 did not align exactly with the melted copper on Exhibit 1-3792 inside the conduit. The initial alignment resulted in an approximate 5-cm (2-inch) separation between these arcs.
As the single (forward) arc on Exhibit 1-3790 occurred inside the conduit, it had to have arced to either another IFEN PSU cable, or the 16 AWG control wire. Therefore, the original positioning of the 1-3790/1-3792 pair of cables had to be adjusted slightly (within the 5-cm (2-inch) range) to align all of the copper melts. As with Exhibit 1-3791, the fact that a single arc event took place on one wire that subsequently arced approximately 51 cm (20 inches) farther aft indicated that the initial arcing event did not trip the CB. The arcing on Exhibit 1-3790 that occurred outside the aft end of the conduit involved all three phases. This would have tripped the CB, indicating that the forward arc occurred first and did not trip the CB.
Various combinations were tried to determine the best placing for the arc-damaged IFEN PSU cable and 16 AWG wires segments, particularly with respect to their positioning in relation to the localized heat zone noted on either side of the two clamps. However, all of the combinations had to take into account the regions of missing tin on the 1-3790/1-3792 pair of PSU cables. For the various layouts, this region of missing tin was always matched to the area of the two clamps on FBC and FDC, as this was a known location from which to start. No other combination or layout could be supported by the physical evidence on the cables and wires.
As indicated above, based on the layout of the cables and wires, it is possible to assess the direction of fire propagation based on the sequence of the arcing events. The aft arcs on exhibits 1-3790 and 1-3791 would most likely have tripped their associated CBs; therefore, the forward arcs must have occurred first, and not tripped their associated CBs. This strongly suggests that the fire was moving forward to aft.
The region of missing tin represented an area of higher heat. If this had been an earlier event, it is strongly suspected that all three cables would exhibit similar arcing events in the vicinity of 1-3790 outside the aft end of the conduit. With the cables and control wire laid out as described above, all of the regions of melted copper could be attributed to arcing events between phases on the same cable, between the cables and the control wire except for the arc event that took place at the forward end of 1-3791, or both. There was no matching arc damage on cable 1-3793 in this area. However, the continuation of exhibits 1-3790/1-3792 from approximately STA 401, along with the 16 AWG control wire forward, were not identified. Therefore, no determination could be made with respect to exactly what the single wire from 1-3791 had come in contact with at the forward end.
188.8.131.52 Three identified arced wires from aircraft systems
The three exhibit numbers discussed in this section are 1-3029, 1-1733, and 1-12755.
Of the three identified arced wires from aircraft systems, two were accurately placed such that the arcs were located about 15 cm (6 inches) aft of the right oval hole in the overhead switch panel housing. (See Figure 23.) The arc on the third wire was located in the same general area. From a potential arcing perspective, this area is considered benign in that the wires, as installed, have little likelihood of being chafed or otherwise damaged. However, there are MPET-covered insulation blankets in close proximity to the wires. The three wires were assessed regarding their potential to be related to the lead ignition event.
Exhibit 1-3029 is a section of 10 AWG tin-coated, XL-ETFE (BXS7008) insulated wire from the left emergency AC bus feed cable. The area of melted copper was approximately 15 cm (6 inches) outside of the right oval hole in the overhead switch panel housing. The functions powered by the left emergency AC bus were lost at 1:25:06. The arc on this wire would have tripped the left emergency AC bus remote controlled CB. If this arcing was connected to the lead event, the loss of this bus would have been obvious to the pilots, and the loss of associated systems would have been recorded on the FDR much earlier than when they were actually recorded. The arc on this wire was the result of fire damage, and was not connected to the lead ignition event.
Exhibit 1-1733 is a section of 24 AWG nickel-coated, polyimide-insulated wire from the Engine 2 fire detection loop "A" circuit. The wire was severed by an arc event at one end. The area of melted copper occurred about 15 cm (6 inches) outside the right oval hole in the overhead switch panel housing. The arc on this wire would have caused the Engine 2 fire detection loop "A" circuit to open, or the associated CB to trip, causing loop "A" to be de-powered. The fire detection control unit would then send a fault to the DEU, which would be displayed to the crew as a Level 1 (amber) "FIRE DET 2 FAULT" alert on the EAD. A fire alarm would not be generated, nor would an overhead warning light illuminate. There was no mention by the crew on the CVR of any alerts being displayed before the smoke appeared in the cockpit. This arcing event most likely occurred as a result of fire-related damage to the wire, and was not likely connected to the lead ignition event.
Exhibit 1-12755 is a section of 22 AWG nickel-coated, polyimide-insulated wire from the high-intensity lights (supplemental recognition) wingtip strobe lights circuit. The high-intensity wingtip strobe lights are turned on in the cockpit by the HI-INT push button located in the overhead light switch panel. When the lights are off, the button illuminates a blue OFF legend. This wire is powered when the lights are on. The loss of power to the wire will result in the high-intensity lights shutting off, but the OFF legend in the switch will not illuminate as long as it is in the ON position and the left ground sensing relay R2-5009 is powered. Therefore, a shorting of this wire would be a hidden event for the crew unless a CB tripped and was noted.
Exhibit 1-12755 was severed by an arcing event at one end. In the reconstruction mock-up, the location of the wire could not be precisely determined; however, it had been installed in the wire run between the forward switch panel receptacle R5-204 in the overhead switch panel housing and the electrical connector plug P1-420 in the overhead disconnect panel. There is no indication that any wire arcing occurred within the overhead switch panel housing; therefore, the arc on this wire likely occurred between the overhead switch panel housing and the disconnect panel, most likely at about 15 cm (6 inches) outside the right oval hole in the same location as the other known fire-related arcing in that area. This suggests that the arcing event occurred as a result of fire-related damage, and was not connected to the lead ignition event.
184.108.40.206 Nine arced wires–Locations not determined
The nine exhibit numbers discussed in this section are 1-3700, 1-3713, 1-3718, 1-3796, 1-4689, 1-11252, 1-11897, 1-12756, and 1-12809.
The exact installed location and system function of each of the nine arced wires could not be determined. It is highly unlikely that all nine wires arced at the same location and time.
220.127.116.11.1 Exhibits 1-4689 and 1-11897
Exhibits 1-4689 and 1-11897 were identified as sections of 10 AWG tin-coated wire, with the insulation missing. Based on the tin coating, it is likely these two sections were insulated with MIL-W-22759 type insulation. The left emergency AC bus displayed arcing damage; this wire was 10 AWG tin-coated, with MIL-W-22759/34 type insulation. It is also known that power to this bus feed was lost at 0125:06, when numerous functions powered by this bus were simultaneously lost.
Loss of the left emergency AC bus would result in the left emergency DC bus being powered by the aircraft battery, and the left emergency AC bus being powered through a static inverter also powered by the battery. Although the left emergency AC remote control CB (RCCB) most likely tripped as a result of the arcing event at 0125:06, there is no CB protection for the left emergency AC bus when powered from the static inverter. The current is limited only by the inverter itself; therefore, electrical power would continue to be fed to any short-circuit until the inverter itself failed. Therefore, it is possible that exhibits 1-4689 and 1-11897 could be from the left emergency AC bus feed.
Other 10 AWG wires routed within the fire-damaged area were also assessed. Three systems or components were powered by 10 AWG wires. One 10 AWG wire was installed completely within the overhead switch panel housing, where it is unlikely that any arcing took place. The remaining two 10 AWG circuits were associated with the tail tank alternate fuel pump and the Tank 2 left aft fuel pump. Both of these three-phase power circuit wires were routed through the right side of the forward cabin drop-ceiling.
Of these two pumps, only the Tank 2 left aft pump would have been powered at the time of the initial odour. According to the wiring diagram for this circuit, the three 10 AWG wires, C104-147(148) (149)-10, were routed between STA 475 aft to STA 1059. Also, according to the Boeing conduit list, the 10 AWG Tank 2 left aft fuel pump wires were polyimide insulated and nickel coated, not tin coated. As the most forward location for these wires was STA 475, they were considered to have been located too far aft to have been involved as a potential source of ignition.
18.104.22.168.2 Remaining unidentified exhibits
Exhibit 1-11252 was a section of 24 AWG nickel-coated, polyimide-insulated wire. The physical appearance of Exhibit 1-11252 was almost identical to Exhibit 1-1733 (a segment of the Engine 2 fire detection loop "A" circuit) and could be a matching end, and as such a continuation of that wire.
Exhibits 1-3700 and 1-3718 were sections of 20 AWG nickel-coated, polyimide-insulated wires, and exhibits 1-3713 and 1-12809 (see Figure 20 for a photograph of 1-12809) were sections of 24 AWG nickel-coated, polyimide-insulated wires. These wires could not be associated with any particular circuit or system. During the final 92 seconds of the FDR operation, numerous systems anomalies were recorded. Two of the recorded anomalies were related to systems that were powered by 20 AWG wires, and six were related to 24 AWG wires. Any of these anomalies could have resulted from either an arc or from thermal tripping of the system CB.
Exhibit 1-12756 was identified as a section of 18 AWG tin-coated, polyimide-film-insulated wire. This wire was unusual in that nickel-coated, polyimide-film-insulated wire was the standard used during the manufacture of the aircraft. Exhibit 1-12756 could be related to a modification made to the aircraft following manufacture, but it could not be positively identified. As this wire could not be placed in the reconstruction mock-up, its potential involvement in the lead event could not be assessed from a systems perspective.
Exhibit 1-3796 was recovered as part of the bundle of entangled wires (Exhibit 1-4372) that contained the arced IFEN PSU cable segments, suggesting that it may have been installed in the same area of the aircraft. It was determined that these PSU cable segments had been installed above Galley 2 (see Section 22.214.171.124), starting in the vicinity of the cut-out in the top of the cockpit rear wall and running aft to about STA 420. Exhibit 1-3796 was assessed for its potential to be involved with the lead arcing event.
The area between the cut-out in the top of the cockpit rear wall aft to STA 420 (above Galley 2) was inspected on all of Swissair's fleet of MD-11s for potential anomalies that could lead to arcing. The wire bundles and conduits run relatively straight in that area, and the area is not considered to be susceptible to damage from routine maintenance operations or contamination. The threat from mechanical wire chafing in that area was considered to be low. During the inspections, no potential anomalies that could lead to arcing were found.
To create the 2-cm copper melt on Exhibit 1-3796 would require a significant arc-tracking event. Such an arc-tracking event would almost certainly have involved at least one other wire arcing, and would have resulted in significant damage to a number of adjacent wires. Significant collateral damage to nearby wiring is often seen when similar arc tracking occurs in laboratory testing, and may account for some of the other arced wires that were found but not positively identified as to location or circuit function.
Exhibit 1-3796 was also assessed for its potential to be connected to a lead arcing event in the area forward of the cut-out in the top of the cockpit rear wall, behind the avionics CB panel. Such a scenario is considered unlikely for the following reasons. In laboratory testing, similar arcing events are known to produce a series of loud snapping-type sounds. These loud snapping sounds are typically accompanied by brilliant flashes of light similar to arc welding. In the MD-11, such flashes could potentially be seen in the (darkened) night cockpit lighting conditions through the small openings around the CB panel, or around the edges of unused CB holes. It is unlikely that the type of arcing event that produced Exhibit 1-3796 could be mistaken by the pilots as an air conditioning anomaly if it occurred behind the avionics CB panel. If this type of arcing event occurred behind the avionics CB panel, it would be expected that the arcing would produce significant damage to adjacent wiring. During such an event, it is most likely that one or more systems alert messages would appear, anomalies would be recorded on the FDR, or CBs would trip. Again, no such anomalies were mentioned by the pilots or recorded on the FDR for some 13 minutes.
126.96.36.199 Hella map lights
The first officer's and the right observer's map lights were recovered, examined, and ruled out as potential sources of ignition for the fire. The captain's and the left observer's map lights were not found in the recovered wreckage. The map light fixture installed at the left observer's position did not have any history of electrical anomalies similar to the Hella map lights, and it was ruled out as a potential ignition source.
The Hella map light in close proximity to the MPET cover material at the captain's map light position presented a potential lead ignition-event scenario. Airflow flight testing showed that some of the test smoke generated above the cockpit ceiling at the captain's map light position would enter the cockpit around the left window air diffusers. It would almost certainly enter from one or more other locations also, including the map light housing, the left-side window diffuser slide control, and the engine fire handles.
If the fire started immediately overhead of the captain, it would be expected that he would detect the odour first; it appears that this was not the case. Also, if the initial smoke was coming from the area of the map light, it would not have been necessary for the first officer to stand to inspect the suspected area. Smoke entering through openings remote from the diffusers, especially through the map light housing itself, would be less likely to be mistaken for air conditioning smoke. Furthermore, a lead ignition event this far forward in the aircraft would not lead to the substantial fire-related damage that occurred in the attic area of the forward passenger cabin in the known time frame of the fire. The available information indicates that the fire did not start in any of the map lights.
188.8.131.52 Inside the overhead switch panel housing
The examination of the recovered material from inside the overhead switch panel housing showed little heat damage other than to a localized area at the aft end. There was no indication that the fire started inside the housing and propagated out. The heat damage pattern shows that the heat originated outside the housing, and entered through the aft cut-outs.
184.108.40.206 Forward galleys
Galley 2 was not electrically powered, and none of the recovered wires from inside galleys 1 and 3 displayed any heat or fire damage. All of the heat damage and soot accumulation on the top portions of these galleys was from exposure to an external fire. There was no arcing damage to any of the identified galley wiring that was recovered.
The galleys would have been in use at the time of the detection of the initial odour in the cockpit. If a galley power feed wire were to arc, the galley load control unit would sense a differential between the input and output, and would shut off power to the galley. The appropriate galley OFF light in the cockpit overhead control panel would illuminate, and a galley OFF Level 1 (amber) alert would be generated. This would likely have been apparent to the flight crew. There were no CVR references to any galley problems. The available information indicates that the fire did not start within one of the galleys.
220.127.116.11 Overhead aisle and emergency light fixtures
Discolouration was found on some of the cabin ceiling panel assemblies, both in the wreckage from SR 111 and during subsequent examinations of other MD-11 aircraft. The discolouration was caused by an overheating of the overhead aisle and emergency light assemblies by the lamp. Other than the potential for dust and lint deposits, there is no flammable material, such as MPET cover material, in close proximity to the light fixtures. It is assessed that the fire was not initiated by one of these light fixtures.
18.104.22.168 Emergency lights battery pack
Examination of the battery pack showed that, although it was extensively heat damaged, the heat occurred from the outside in (see Figure 27). This indicates that the fire did not start from a heat condition, such as thermal heating, within the battery pack.
1.14.12 Fire propagating materials
22.214.171.124 Insulation blankets–General
Thermal acoustic insulation materials are used extensively throughout the aircraft fuselage to maintain comfortable cabin temperatures, and to reduce the noise entering the passenger cabin and cockpit (see Figure 4). While material, such as fluoropolymer composite or polyethylene foams have been used for this purpose, the most popular choice is the insulation blanket. These insulation blankets are typically installed immediately adjacent to the inside of the fuselage skin, over the frames and around the outside of air conditioning ducts.
Insulation blanket construction consists of a batt of fibreglass insulating material encapsulated by a protective cover in the form of a thin moisture barrier film. This protective cover is a composite construction in which a thin web-like polyester or nylon scrim can be glued to the film material for the purpose of producing a tear-stop. Splicing tape may also be used to seal several insulation blankets into a single unit. Thermal acoustic insulation materials must comply with flammability requirements described in FAR 25.853, Appendix F.
Factors that are considered when selecting the cover material for the blankets include durability, fire resistance, weight, impermeability, and ease of fabrication. Two materials that are widely used in the aviation industry and that were used in the occurrence aircraft are polyethylene terephthalate (PET) and PVF. PET material is commonly known as Mylar®,Footnote 69 and PVF material is commonly known as Tedlar®.Footnote 70 Both materials could be either metallized or non-metallized, and both were approved for use based on the applicable FAA certification tests at the time.
The flammability test used to certify MPET-covered insulation blankets was the vertical Bunsen burner test (see Section 126.96.36.199). This test involved suspending a strip of insulation material vertically over a Bunsen burner, applying flame for 12 seconds, and then removing the flame. To pass the test, a minimum of three specimens of insulation blanket material must self-extinguish within an average flame time of 15 seconds after the flame is removed. Also, the average burn length must not exceed 20 cm (8 inches), and drippings from the insulation blanket material must not flame for longer than an average of 5 seconds. MPET-covered insulation blankets met these requirements: when exposed to the Bunsen burner, it immediately shrivelled up and shrank away from the burner and did not ignite.
Douglas used MPET-covered insulation blankets in various models of production aircraft between 1981 and 1994. The use of MPET-covered insulation blankets was superseded by non-metallized PET-covered insulation blankets.
In the occurrence aircraft, which was built in 1991, MPET-covered insulation blankets were used to insulate the fuselage. They were also used to insulate some of the air conditioning ducts. Most of the air conditioning ducts were insulated with metallized polyvinyl fluoride (MPVF)-covered insulation blankets (see Figure 4).
188.8.131.52 Past known occurrences
Between November 1993 and March 1999, seven known occurrences took place in which either MPET- or MPVF-covered insulation blankets had been ignited and propagated flame. These occurrences involved one MD-87, one MD-82, two B737-300s in 1994 and 1995, and three MD-11s in 1995.
The ignition source for each fire was relatively small, including wire arcing, hot metal shavings, and a ruptured light ballast case. In all but one instance, the fires occurred when the aircraft was on the ground. In this one instance, the time the fire occurred could not be determined, as the damage was only discovered during subsequent maintenance.
The Civil Aviation Administration of China (CAAC) investigated three of the above occurrences: the two Boeing 737 aircraft that had PET and one MD-11 aircraft that had MPET. According to the documentation available, the CAAC conducted testing on the PET-covered insulation blanket material (Boeing material specification BMS8-142). It was found that once ignited, the material would be completely consumed by fire. In a report dated 24 May 1996, which was forwarded to the FAA, the CAAC recommended that the manufacturer be advised that "the insulation blanket installed in the Boeing 737-300, [and] MD-11 airplanes is fire flammable. They should make a prompt and positive response."
In a response to the CAAC report dated 24 July 1996, the FAA stated that they intended to investigate the behaviour of insulation blanket materials under larger scale conditions. The FAA also stated that, while the tests conducted by the CAAC on the PET were illustrative, the type of CAAC testing conducted (igniting at the sewn edge of the sample material) was not required for certification.
On 9 August 1996, Douglas released an AOL to operators of several of its aircraft types concerning insulation blankets. The AOL contained the following information:
As a result of recent MD-80 and MD-11 ground fire incidents involving insulation blankets covered with metallized Mylar material, Douglas has examined its methods for flammability testing of insulation blankets. We have concluded that an expanded set of test conditions, which includes additional ignition conditions beyond those previously required, better determines blanket flammability characteristics. All insulation blanket materials delivered on Douglas manufactured aircraft have met the applicable requirements for FAA certification. Douglas recommends that operators discontinue use of the reference (D) metallized Mylar blanket covering material and reference (E) tapes. Douglas also recommends that Douglas' expanded test criteria, which is published in the enclosed reference (C) DMS 2446, be applied when operators are replacing blankets in aircraft in-service....
Douglas has made the FAA and industry aware of our conclusions relative to flammability testing and is participating in an FAA/Industry Flammability Working Group that is addressing testing methods and the flammability of materials such as those used for insulation blankets. The working group will perform flammability tests of blanket covering materials from known suppliers, testing specimens of different sizes in different test setups. From the data derived from the working group tests and from tests that Douglas will continue to conduct, Douglas intends to develop an even more rigorous set of flammability test requirements.
DMS 2446 was dated 5 August 1996 and introduced a particular flammability test that was to be used by all McDonnell Douglas suppliers of insulation blanket assemblies. The test, developed by aircraft manufacturers, involved exposing a sample of the insulation blanket assembly to ignited cotton swabs saturated with isopropyl alcohol (the cotton swab test). McDonnell Douglas had found that when tested by this method, MPET-covered insulation blankets ignited and continued to burn.
The AOL went on to explain that McDonnell Douglas was currently installing PET-covered blankets in production aircraft, and that they were seeking to identify improved materials that would meet a more rigorous set of flammability test conditions, while at the same time meeting other desirable characteristics. Ultimately, McDonnell Douglas issued an SB, dated 31 October 1997, that recommended that MD-11 operators remove and replace MPET-covered insulation blankets with MPVF-covered insulation blankets. The SB also declared that MPVF-covered insulation blankets would be used in production aircraft.
In November 1989, the FAA, along with other regulatory authorities and various industry representatives, formed the International Aircraft Materials Fire Test Working Group. In 1996 to 1997, this working group conducted testing to evaluate the performance of various insulation blanket cover materials against both the Bunsen burner certification test and the cotton swab industry tests. This resulted in a document disseminated by the US Department of Transportation, dated September 1997 and entitled Evaluation of Fire Test Methods for Aircraft Thermal Acoustical Insulation (DOT/FAA/AR-97/58). The following excerpts are from this document:
This report presents the results of laboratory round robin flammability testing performed on thermal acoustical insulation blankets and the films used as insulation coverings. This work was requested by the aircraft industry as a result of actual incidents involving flame propagation on the thermal acoustical blankets. Vertical flammability testing was performed as specified in Federal Aviation Regulation (FAR) 25.853, Appendix F. In addition, a cotton swab test developed by the aircraft manufacturers was also evaluated. These cotton swab tests were performed by placing ignited alcohol-saturated cotton swabs on a test-sized blanket and measuring the longest burn length. Test results indicated that the cotton swab tests produced consistent test results, whereas the vertical flammability tests did not. This was especially apparent with one particular film covering which passed the vertical test according to 50% of the participating laboratories while this same film during the cotton swab tests was reported to have been consumed by all but one laboratory which reported that 75% of the sample was destroyed....
Metallized poly (vinyl fluoride) (PVF) and metallized and nonmetallized polyester poly (ethylene terephthalate) (PET) are currently the most widely used films in the aircraft industry....
In air, PET burns with a smoky flame accompanied by melting, dripping, and little char formation. Therefore, fire-retardant treatments are necessary. The fire-retardent treated grades are generally prepared by incorporating halogen or nonhalogen containing materials as part of the polymer molecules or as additives. Metal oxide synergists such as antimony oxide are frequently included. Although fire retardent PET films are resistant to small ignition sources in low heat flux environments, they can burn readily in fully developed fires....
In air, biaxially oriented PVF film (Tedlar) has burn characteristics similar to PET film....
The front face of the metallized PET blanket sample was totally consumed when subjected to the cotton swab test. This was reported by all but one lab, which reported that 75% of the front face was consumed. This is in sharp contrast to the vertical flammability test results which indicated that the metallized PET/fiberglass samples (compressed and noncompressed) passed most of the time. Hence, the cotton swab test proved itself to be a more reproducible test than the vertical flammability test for this particular film/fiberglass assembly....
The grade of metallized PET film evaluated in this round robin is flammable and possibly could propagate a fire in a realistic situation.
The Evaluation of Fire Test Methods for Aircraft Thermal Acoustical Insulation document described five incidents (as included in the seven occurrences noted above) that occurred between 1993 and 1995 and involved flame propagation on insulation blankets.
Subsequent to the SR 111 accident, in a release dated 14 October 1998, the FAA administrator stated that the FAA would develop a new test specification for aircraft insulation materials and would require that existing materials be replaced with insulation that would pass the new test. On 20 September 2000, the FAA issued an NPRM that advocated upgraded flammability standards for all thermal acoustic insulation materials.
By the end of 1997, McDonnell Douglas had discontinued the use of both MPET- and PET-covered insulation blankets in production aircraft. However, use of MPET-covered insulation blankets continued until 2000, when the FAA issued ADs requiring the removal of such blankets from existing aircraft. The FAA also issued an NPRM proposing new flammability standards for thermal acoustic insulation materials.
184.108.40.206 Contamination effects on insulation blanket cover material
Testing carried out on behalf of the TSB showed that several materials found in the fire-damaged area of SR 111 are flammable even before they are exposed to their intended operating environment; that is, they are flammable in an uncontaminated state. Examples of such flammable materials include insulation blanket cover materials, splicing tapes, polyethylene foam, and silicone elastomeric end caps.
Little industry guidance is available to quantify the effects of contamination. According to documentation from various sources,Footnote 71 the flammability characteristics of materials can degrade while in service; that is, when they are exposed to contaminants such as dust, lint, adhesives, grease, oil, or corrosion inhibitors.Footnote 72 No corroborating test results were available to support this information. In some flammability testing conducted by the TSB in which lightly contaminated insulation blankets removed from an in-service MD-11 were tested, no appreciable differences were noted in the flammability characteristics of the material.
The aviation industry has yet to quantify the impact of contamination on the continuing airworthiness of insulation blankets. However, research has shown a connection between flammability and contamination. The following extract is from the FAA's Flight Standards Information Bulletin 00-09, issued 28 September 2000 and expired 30 September 2001 entitled Special Emphasis Inspection on Contamination of Thermal/Acoustic Insulation:
Research data has shown, however, that the flammability of most materials can change if the materials are contaminated. Contamination may be in the form of lint, dust, grease, etc., and can increase the material's susceptibility to ignition and flame propagation.
During the examination of several Swissair MD-11 aircraft during the investigation, contamination (as described in Section 1.12.5) was observed on items such as light fixtures and wire harnesses. Contamination was also noted on insulation blanket cover materials within the fire-damaged area; however, little or no contamination was evident in the areas above the cockpit ceiling.
1.14.13 Potential increased fire risk from non-fire-hardened aircraft systems
Under regulations in place at the time the MD-11 was certified, no requirement existed to determine whether a failure of any material used in an aircraft system would exacerbate a fire in progress. A premature breach of certain systems, such as oxygen, hydraulic, and conditioned air, could exacerbate an in-flight fire.
The crew oxygen supply lines in the MD-11 were originally manufactured from aluminum tubing. During aircraft manufacture, the aluminum lines were found to be susceptible to handling damage; therefore, the tubing material, along with the majority of fittings, were changed to corrosion-resistant (CRES) steel. Although McDonnell Douglas replaced the aluminum tubing and many of the fittings with CRES steel, McDonnell Douglas continued to use aluminum cap assemblies (e.g., AN 929-6) on unused but pressurized lines. Such an aluminum cap assembly was used on the 8-cm (3-inch) long stainless steel line that was branched off the main oxygen supply line located above the cockpit ceiling at STA 374. This cap assembly was installed in such a way that it protruded through the insulation blankets. During the fire, this area was exposed to flames and heat.
Furnace testing was conducted at the TSB Engineering Branch on a representative CRES steel line/aluminum cap assembly to observe the effects of elevated temperatures on the dissimilar metals. The normal operating range of the MD-11 crew oxygen system is 62 to 85 psi. During the tests, the line was pressurized to 70 psi, and uniform heating was applied. On some tests, leakage occurred at temperatures as low as 427°C (801°F); at temperatures above 427°C (801°F) the aluminum caps lost their installation torque.
Tests were conducted at temperatures between 566°C (1 051°F) and 593°C (1 099°F). After an exposure of approximately 10-and-a-half minutes, the aluminum cap assembly would typically fracture into two pieces, leaving the end of the line fully open. At this temperature range, leakage would occur prior to the fracture.
Tests were also conducted at temperatures of 649°C, 704°C, and 760°C (1 200°F, 1 300°F, and 1 400°F). The aluminum cap assemblies fractured at approximately 5 3/4 minutes, 4 minutes, and 3 1/4 minutes respectively. Metallurgical analysis of the cap fracture surfaces showed that these temperatures caused grain growth to take place, and that the failures occurred in the form of inter-granular fractures along the weakened grain boundaries. In these tests, no discernible leaking took place before the fracture, as the accelerated grain growth caused the deformation and fracture to occur before the time required to initiate a leak.
For comparison, similar testing was conducted using CRES steel caps instead of the aluminum caps. With the CRES steel caps, there was no loss of installation torque, and the caps did not leak or fracture, even when the assembly was exposed to a temperature of 760°C (1 400°F) for 20 minutes.
The testing was considered conservative in nature, in that uniform heating was used. In the occurrence aircraft, there would likely have been non-uniform heating effects. For example, since the cap assembly protrudes through the insulation blankets and the line does not, the cap assembly would be heated first by the fire and to a greater extent than the line. In addition, a thermal gradient would already exist between the supply line, which is adjacent to the cold airframe exterior, and the cap assembly, which is exposed to the warmer interior.
If this end cap were to leak or fracture during a fire, pure oxygen would enter the fire environment, significantly exacerbating the fire situation. Also, a cap failure would result in a loss of pressure in the line; this would stop the flow of oxygen to the pilots' oxygen masks.
Within the area of the fire damage, elastomeric end caps were used on the air conditioning ducts. Fire tests disclosed that the elastomeric end caps could be easily ignited by a small flame ignition source. Once ignited, the integrity of the end caps was destroyed by a self-propagating flame front. Fibreglass hoses and connectors were also used on the air conditioning system throughout the aircraft. This material is heat tolerant; nevertheless, when tested in a cone calorimeter, the material ignited about two-and-a-half minutes after exposure to a heat flux of 25 kilowatts per square metre, which is equivalent to about 1 095°F (591°C). A breach of the air conditioning system in the area of the fire would introduce a significant flow of air that would exacerbate the fire. Heat damage to the structure in the reconstruction mock-up indicates that such temperatures were likely reached or exceeded in some areas where fibreglass hoses were installed.
FAR 25.1309 requires that a system safety analysis be conducted as part of a system's certification process. Although it is an established aviation industry practice, during the certification process, to consider the consequences of a system's failure, typically the system safety analysis does not include an assessment of the consequences of the system's failure as a result of a fire in progress.
1.15 Survival aspects
The high forces created when the aircraft struck the water resulted in a non-survivable accident.
1.16 Tests and research
This section describes the various testing methods used, and inspections and research conducted, during the SR 111 investigation, as well as the results of these activities. It also presents statistics from other occurrences involving smoke or fire.
1.16.1 AES examination of the recovered arced beads
All of the copper wire melt beads from SR 111 were examined by Auger electron spectroscopy (AES)Footnote 73 (see Section 220.127.116.11). 3AES3 provided a method to determine quantitatively, the surface chemistry or elemental composition of the melt beads as a function of depth below the surface. AES examination had the added benefit of being essentially non-destructive, as the depth profiling did not normally go below 5 000 Angstroms.Footnote 74 The elemental chemical data collected could be used to provide a comparative analysis between samples. Review of the available literature indicated that it may be possible to use this comparative analysis to differentiate between a copper bead arced in a clean environment (pre-fire) and one arced during a fire in a smoke-filled environment. Wires that arced in a clean environment could be identified as possible initiating events.
To assist in developing a protocol for the examination and comparative analysis of copper beads by AES, a number of beads were formed under known arcing and fire conditions. Twenty-four of these exemplar beads were examined and analyzed in a blind test. The results of these tests were that 7 of 14 beads formed in a clean environment were correctly identified as such. Of the 10 beads formed in a fire environment, 1 was incorrectly characterized as pre-fire, and 9 were characterized as inconclusive. This latter characterization highlighted a problem in using the AES methodology to assess arc beads that had been subjected to an ongoing fire, regardless of the environment present at the time of the arc. The fire subjected the copper melt surfaces to heavy oxidization that formed a crust, or environmental cap. When this cap was present, it was not possible to make any determination about the environment at the time the bead was formed.
Several other difficulties were encountered using the AES technique as a means to collect data for characterizing the environment surrounding the bead when it was formed. The irregular surface shapes of the copper melt sites on the SR 111 beads made it difficult to find a suitable flat surface on which to conduct the examination. Many of the sites were contaminated with the remnants of charred wire insulation and whitish- and greenish-coloured precipitates or deposits caused by exposure to sea water. This contamination resulted in a static charge build-up during the testing process, and made it difficult to locate sites that had been pre-defined for examination. Although each of the beads was ultrasonically rinsed in distilled water before being examined, this procedure did not remove all of these artifacts. Nor could the artifacts be readily removed by any other method; that is, given the small depths being examined, any physical distortion of the surface caused it to be potentially unusable for AES examination.
During the testing, there was a lack of repeatability, even in the data that was collected from sites that were just micronsFootnote 75 apart on the same bead. In many cases, this lack of repeatability led to different interpretations of the environment present at the time the bead was formed. As the AES test results did not yield repeatable data that could be consistently interpreted, the comparative analysis using the AES methodology was not used in assessing the involvement of individual beads in the lead arcing event.
18.104.22.168 Wire inspection of in-service MD-11 aircraft
Aircraft wiring in several in-service MD-11s was examined for sources of potential arcing and for any other sources of inappropriate heat generation. TSB investigators visited two maintenance facilities and examined several MD-11 aircraft in the areas of known heat damage in the SR 111 aircraft. The following anomalies were discovered on one or more of the aircraft examined:
- Chafed and cut wires in the forward cabin drop-ceiling area above both the L1 and R1 doors;
- Light chafing of the wire insulation topcoat on several wires behind the cockpit overhead CB panel, in the vicinity of where wire bundles enter the overhead switch panel housing;
- Damaged, cracked, or chafed wires in several other areas;
- Broken bonding wires,Footnote 76 and wires exhibiting bend radii that were smaller than manufacturers' specification;
- Wire terminal connections with insufficient torque;
- Inconsistencies in the routing of wires and wire bundles;
- Physical openings in the smoke barrier installed above the cockpit wall between the cockpit and cabin; and
- Inconsistencies in the installation location of the emergency lights battery pack above the cockpit door entrance.
No direct relationship between the wiring discrepancies discovered during these inspections and the damaged wires from the Swissair 111 wreckage was established.
1.16.2 Map light testing and research
In December 1999, Swiss AAIB investigators, on behalf of the TSB, monitored a Swissair program to remove MPET-covered thermal acoustic insulation from their MD-11 aircraft. Investigators discovered that the insulation material adjacent to some of the map lights showed signs of heat damage. In many cases, the back of the map lights installed in the flight crew positions were in direct contact with the insulation material. This combination provided a potential source of ignition adjacent to a flammable material.
Subsequent examination of the Hella map lights, on the Swissair MD-11 fleet and other MD-11s maintained by SR Technics, revealed that some had damage to the insulating protective caps ranging from cracks to missing pieces; instances of arcing damage were also found on the metal contact spring and the carrier frame.
Based on this information, the TSB issued an Aviation Safety Advisory to the NTSB and relevant stakeholders on 3 March 2000. On 20 April 2000, the FAA issued an AD requiring an inspection of the Hella map light installations on US-registered MD-11s. Although this AD did not mandate that inspection results be reported to the FAA, some voluntary responses were forwarded to Boeing. These results revealed that about 40 per cent of the map lights sampled had some discrepancy, such as heat damage to the wire and cracked insulating protective caps.
Subsequent testing of the Hella map light demonstrated that, with pieces missing from the insulating protective cap, arcing between the metal contact spring and the carrier frame occurred at two locations on the carrier frame. To simulate potential in-service conditions, the Hella light was exposed to vibration during an arcing event. It was observed that the vibration extended the duration of the arcing, and the CB did not trip.
To simulate an actual aircraft installation, a map light was tested in a confined space, surrounded by, and in contact with, MPET-covered insulation blankets. Temperatures in the confined space stabilized at 151°C to 159°C (304°F to 318°F). After two months of continuous testing, the inside of the insulation blanket exhibited heat damage that was similar to the damage noted on in-service aircraft installations.
To assess the actual operating conditions, temperature measurement strips were fastened to the insulation blankets behind the Hella map lights in three MD-11 aircraft. A maximum temperature of 77°C (171°F) was recorded and there was no heat damage to the insulation blankets. One of the test aircraft had more space between the map lights and the insulation blanket. The space provided better ventilation around the map lights, which resulted in a lower operating temperature.
Further examination of the Hella map light revealed that there were additional failure modes, other than damage to the insulating protective cap, in which the light could be involved in an arcing event. The additional possibilities are as follows:
- A short-circuit can occur between the U-shaped universal joint suspension bracket and the wire terminal connection;
- A short-circuit can occur between the U-shaped universal joint suspension bracket and the ON/OFF microswitch assembly; and
- A short-circuit can occur between the spare bulb holder and the ON/OFF microswitch assembly.
Prompted by an FAA Safety Significant Finding unrelated to this investigation, Hella carried out tests to measure the heat developed by the MD-11 map light installation. As a result of the testing, Hella drafted an SB, for the replacement of the 11.5 W halogen lamp with a 7 W incandescent bulb.
1.16.3 Airflow flight tests
Two separate flight tests were conducted to assess airflow patterns in the cockpit; the space above the cockpit ceiling, and the attic space above the forward cabin ceiling. The first test was conducted by the TSB on 27 January 2000 at Long Beach, California, using Swissair MD-11 aircraft HB-IWE and Boeing equipment and facilities. The second test was conducted on 2 December 2000 by Swissair and Boeing in Zurich, Switzerland, using Swissair aircraft HB-IWE. The Swiss AAIB attended the second test flight and collected data on behalf of the TSB.
The airflow flight tests yielded the following results:
- Smoke originating inside the flight crew compartment, forward of the cockpit rear wall, does not move aft into the cabin, but is mainly drawn downward into the avionics compartment below the cockpit floor via the left- and right-side rudder pedals.
- Smoke originating from above the ceiling liner on the right side of the cockpit or behind the avionics CB panel initially migrates to the right and goes down the ladder; when the volume of smoke is sufficient, it enters the overhead panel housing through the aft oval cut-outs and enters the cockpit through the cut-outs for the fire handles.
- Smoke originating behind the ceiling liner on the left side of the cockpit enters the cockpit in one or both of two locations: around the left window air diffusers, or through the left diffuser control slide panel opening.
- The flow of smoke originating anywhere forward of the cockpit rear wall is not affected by whether the ECON switch (cabin air recirculation fans) is selected to the ON or OFF position.
- With the ECON switch selected to the ON position, smoke originating aft of the cockpit wall, in the attic space above the forward cabin drop-ceiling, is mainly drawn aft to the recirculation fans. However, some smoke near the cockpit rear wall could be drawn forward into the cockpit attic or down the cable drop and into the cockpit. Upon entering the cockpit through the cable drop, the smoke can migrate forward to swirl in front of the left-side cockpit windows enroute to the captain's rudder pedals, or go from the closet to the right and then up to swirl in an area around the upper outboard corner of the upper main CB panel before continuing forward to the first officer's rudder pedals.
- With the ECON switch selected to the ON position, smoke released in the ceiling area above the L1 and R1 doors was only smelled in the passenger cabin in the area below these two areas.
- With the ECON switch selected to the OFF position, the air in the attic space above the forward cabin drop-ceiling would flow forward toward the cockpit. Smoke produced in the attic migrates with the airflow toward the cockpit, drawn by the air being exhausted from the cockpit via the avionics compartment cooling fan, through the outflow valve. Smoke filling the attic space also tends to drift down into the passenger cabin through any seams or openings available.
1.16.4 Analysis of cockpit sounds recorded on the CVR
During the playback of the CAM channel on the CVR, numerous "click" sounds were heard, many of which were subjectively identified as typical events in a cockpit, such as radio keying, book binders opening or closing, cutlery striking a plate, and the cockpit door opening or closing. Other clicks could not be readily identified, and an attempt was made to determine whether any of the clicks could be the sound of a CB tripping.
Several tests were conducted in an MD-11 cockpit during which CBs at various locations on several CB panels were tripped in a noise environment similar to in-flight conditions. The audio recordings from this testing, and the unknown "clicks" from the SR 111 CVR were digitized and analyzed at the Industry Canada Communications Research Centre. A cross-correlation study was used to detect any similarities between the "click" segments of each digitized file. The analysis of the spectra of the original signals and the cross-correlations revealed that the background noise environment had a significant effect on the signal. Attempts to remove the effects of the background noise environment from the "click" by notch-filtering, linear prediction, spectral subtraction, and median smoothing were unsuccessful.
The results of the Industry Canada Communications Research Centre study were inconclusive. Subjectively, some of the sounds recorded on the SR 111 CVR were similar to the CB sounds recorded during the test in the MD-11 cockpit; however, none were scientifically proven to be similar.
1.16.5 Simulator trials
Several MD-11 simulator sessions were conducted in support of the accident investigation. The sessions primarily assessed MD-11 descent performance, and the potential effects of various system failures. Because of the lack of specific information about the initial cues available to the pilots, the loss of aircraft systems, and the degradation of the cockpit environment in the last five minutes of the flight, no attempt was made to replicate the actual flight.
For some of the testing that was completed to assess systems failures, the simulator was set to the atmospheric conditions, aircraft performance, and aircraft configurations similar to those experienced by SR 111 at the various times during the last 30 minutes of the flight. Various failures of aircraft systems that were recorded on the FDR during the 92-second period immediately prior to recorder stoppage were introduced. Observations were made on the panels, pedestal, and DUs in the cockpit when these failures were introduced. Also, the SMOKE ELEC/AIR selector was rotated to various positions after the failures were introduced. Another test during this session was designed to assess handling qualities of the MD-11 in flight with LSAS failure and a complete electrical failure. It was determined that the simulator was still flyable in each of the following situations:
- With only one channel of the LSAS;
- With no LSAS; and
- With no electrical power available.
1.16.6 Theoretical emergency descent calculations
Theoretical performance calculations, based on manufacturer's performance charts, were completed to assess the capability of the MD-11 in achieving an emergency landing at the Halifax airport in the minimum time possible, from FL330. The objective was to determine the point along the SR 111 route of flight at which the aircraft would have had to start an emergency descent that would result in the earliest possible landing time on Runway 06 in Halifax. The calculations were based on actual wind and other environmental factors, actual SR 111 weight and balance figures, and performance data for a fully serviceable aircraft.
When completing the theoretical calculations, flight crew decision making was not taken into account nor were the various systems-related aircraft unserviceabilities or the deteriorating cockpit environment.
The results of these calculations provide a benchmark from which to consider the limited initial cues available to the pilots and the actual decreasing flyability of the aircraft in the last minutes of its flight vis-à-vis the minimum possible time necessary to fly to the Halifax International Airport and complete a safe landing under ideal theoretical conditions.
To determine the earliest possible potential landing time, engineering simulator data, in combination with FDR-derived actual winds, was used to calculate the aircraft's ground speed during the emergency descent. The ground speed was then mathematically integrated to derive displacement or distance travelled over time. The calculation profile assumed direct tracking to the Halifax Golf beacon from the point of the initiation of the emergency descent, followed by a straight-in segment from the beacon to the threshold of Runway 06.
The calculations identified one point along the flight path where the distanceFootnote 77 from the aircraft to the Golf beacon was equivalent to the distance travelledFootnote 78 along the optimal emergency descent profile. This point coincided with a time of 0114:18. A descent initiated at that time would have required a track of 044 degrees True to the Golf beacon, and would have covered a calculated distance of approximately 62 nm. The derived winds indicated a significant tailwind component for the initial seven minutes of the emergency descent, followed by light headwinds for the remainder of this particular descent and approach.
To examine the potential for SR 111 to be able to land successfully at Halifax airport if an aggressive emergency diversionFootnote 79 had been started at 0114:18, the known significant aircraft systems-related events were transposed onto the theoretical emergency descent profile.
If the aircraft had followed the theoretical emergency descent profile, the first systems failure event apparent to the pilots-the disconnect of the autopilot at 0124:09-would have occurred on the landing approach in the vicinity of the Golf beacon, approximately 5 nm from the threshold of Runway 06. The aircraft would have subsequently experienced progressive systems failures on the approach. When the flight recorders stopped at 0125:41, the aircraft would have been at approximately 700 feet above the runway threshold elevation. The earliest estimated threshold crossing time was 0126:17, which would have been 1 minute, 35 seconds, after the pilots had declared an emergency. Approximately 35 more seconds would be required to land and stop the aircraft; therefore, the completion of the landing would have been at approximately 0127.
In reality, the crew were unaware of the existence of an on-board fire and assessed the source of smoke and fumes as the air conditioning system; the Air Conditioning Smoke Checklist does not call for landing the aircraft immediately. At 0119:50, the aircraft was 30 nm from the threshold of Runway 06, descending at about 3 300 feet per minute (fpm) through FL210, at an airspeed of 320 knots indicated airspeed (KIAS). The pilots indicated to ATC that they needed more than 30 nm.
Completion of the theoretical descent performance calculations enabled the investigation team to assess the pilots' decision that more than 30 nm was needed to complete a landing in Halifax. For comparison, if the crew had continued to the airport on the assigned heading and began an emergency descent profile from 30 nm, they would have intercepted the final approach track at an estimated 15 nm from the threshold while approaching an altitude of approximately 10 000 feet with an airspeed of 355 KIAS. The theoretical descent performance calculations, from a starting time of 0114:18 would have put the aircraft in the same position at approximately 4 000 feet and 200 KIAS. The difference in altitude and speeds would require the aircraft to lose significant altitude and speed requiring off-track manoeuvring, which can lead to a destabilized approach. Therefore, the calculations support the assessment made by the SR 111 pilots at 0119:50 that the aircraft needed more than 30 nm from a descent performance viewpoint.
1.16.7 Statistics for occurrences involving smoke or fire
22.214.171.124 Boeing incident statistics
The Boeing Company performed an analysis of reported in-service events, occurring between November 1992 and June 2000, that involved smoke, fumes, fire, or overheating in the pressurized areas of Boeing-manufactured aeroplanes.Footnote 80 The events under study were assigned one of three general source categories: air conditioning, electrical, or material. Boeing attributed 64 per cent of the events under study to electrical sources, 14 per cent of the events to air conditioning sources, and 12 per cent of the events to material sources. The remaining 10 per cent of the reported events did not include sufficient information to determine the source of the smoke, fumes, fire, or heat. For those events involving MD-11 or DC-10 aircraft, 51 per cent were classified as being electrical in nature, 21 per cent were attributed to air conditioning, and 15 per cent were associated with material causes.
The Boeing study concluded that "larger airplanes with more complex systems show a predominance of smoke events of electrical origin, compared with air-conditioning and material smoke events." The Boeing study also concluded that "for smoke events in which the flight crew could not determine the smoke source, most were subsequently determined by maintenance crews to be of electrical origin."
126.96.36.199 Review of in-flight fire accident data
The TSB reviewed data on in-flight fires that occurred between January 1967 and September 1998 to determine the average time between when an in-flight fire is detected and when the aircraft either ditches, conducts a forced landing, or crashes. The review was limited to fires in commercial transport aircraft with a maximum take-off weight of more than 50 000 lb. Included in the review were any fires that took place inside the fuselage. Events involving engine fires, wheel well fires, and explosions were not considered, nor were events that concluded with a successful landing. The data showed that in 15 representative occurrences, between 5 and 35 minutes transpired between the detection of the first fire symptoms and the crash of the aircraft. Although the circumstances varied in each of these occurrences, the research indicates that when an in-flight fire continues to develop, it can, in a very short time, lead to catastrophic results. In the case of SR 111, the elapsed time between when the unusual odour was first noticed in the cockpit and when the aircraft struck the water was approximately 20 minutes.
The Boeing study, referred to in Section 188.8.131.52, had similarly observed that "[r]eview of historical data on the rare fire events that resulted in hull loss indicates that the time from first indication of smoke to an out-of-control situation may be very short—a matter of minutes."
1.16.8 Electrical ignition tests of MPET-covered insulation blankets
Electrical discharges in the form of arcs or sparks can produce localized temperatures in excess of 5 500°C (9 932°F). A sustained short-circuit event will cause a conventional CB to trip and de-energize the faulted circuit. However, a CB may not trip when an intermittent short circuit exists.
Tests were conducted to characterize the ignition properties and determine whether MPET-covered insulation blankets would ignite when exposed to electrical sparks produced by ground shorts from wires carrying 115 V AC and 28 V DC current. It was observed that MPET-covered insulation blankets would ignite and propagate a flame when exposed to an electrical arc or spark. However, ignition was sporadic in that it sometimes occurred with the first strike of the arc and other times it was not achieved after numerous attempts. The arcs were struck by hand and typically resulted in the tripping of the CB. It appears that electrical arcs were sufficiently rapid in onset and localized to overcome the propensity of a cover material constructed with thin-film material, such as MPET, to shrink away from a heat source.
In one such test, an MPET-covered insulation blanket, similar to those in the occurrence aircraft, was placed between the vertical frames in a section of aircraft fuselage. The blanket was exposed to an intermittent electrical short between an exposed 115 V wire and the grounded fuselage. The MPET-covered insulation blanket ignited, causing a flame to propagate vertically and horizontally across the face and rear surface of the blanket.
1.16.9 Computer fire modelling
During this investigation, the analysis of the fire initiation and propagation was derived from a combination of sources, including detailed wreckage examination and reconstruction, laboratory burn test information, airflow patterns, the sequence of events, and the events timeline. Fire modelling was also used during the latter part of this analysis process.
In January 2002, the TSB contracted the Fire Safety Engineering Group (FSEG) at the University of GreenwichFootnote 81 to conduct computational fluid dynamics (CFD)Footnote 82 modelling using SMARTFIRE® software developed by the FSEG. The objective was to integrate information into a fire field modelFootnote 83 to study the potential effects of different variables on airflow and fire behaviour. The modelling helped to develop better insight into and understanding of the fire, and assisted in evaluating where the fire could have originated. This work also assisted in the interpretation of heat damage patterns by providing data on potential heat release and loss rate possibilities.
The CFD fire field model incorporated information such as the following:
- three-dimensional computer-aided design (CAD) exterior and interior aircraft geometry and construction details;
- material properties and associated fire burn test results;
- design and flight test airflow data; and
- atmospheric and flight profile information from the occurrence aircraft's FDR.
The modelling technology allowed investigators to conduct a series of full-scale virtual burns, using powerful computers to complete a multitude of complex calculations involving the interaction of processes, such as conduction, convection, and radiation. The computer processing of calculations for a single fire initiation scenario often took several days of continuous, uninterrupted, computational time. Subjects studied included potential odour and smoke migration paths, heat release, and complexities, such as heat loss rates to the outside atmosphere through the airframe. As full-scale aircraft fire testing was not an option, it would not have been possible to obtain information about in-flight fire initiation and propagation effects without the use of the fire modelling.
The CFD modelling substantiated the fire scenario presented in this report. When the model was run using the airflow flight test data, air was observed to be drawn into the cockpit interior in the area of the avionics CB panel, and to migrate through the cockpit into the avionics compartment as described in Section 1.16.3. The fire modelling also showed that initial fire propagation and growth characteristics were consistent with the fire scenario presented in this report. For the latter stages of the fire, only limited assessment was done of the information from the fire modelling because of the many permutations and combinations of possible events.
1.17 Organizational and management information
This section includes information about the structure and management of the SAirGroup, Swissair, SR Technics, the Swiss FOCA, the FAA, and The Boeing Company, all of which were involved with either the construction, maintenance, or operation of the occurrence aircraft. Specific information is provided in this section on the Swissair Flight Safety Program, the SR Technics Quality Assurance Program, and the SR Technics Reliability Program.
1.17.1 SAirGroup/Swissair/SR technics
The original Swissair company was founded in 1931 as Swissair Swiss Air Transport Company Limited. This organization evolved into a multi-faceted company, which included several diverse enterprises, such as the airline, aircraft maintenance, airport ground handling, software development, and real estate. In March 1996, a new management structure was introduced, creating a holding company structure organized to provide improvements in management responsibility and accountability. By 1997, the Swissair Swiss Air Transport Company Limited was reorganized into a group of holding companies named SAirGroup.
At the time of the SR 111 occurrence, SAirGroup functioned as the parent company for an aircraft leasing company (Flightlease AG) and the following four subsidiary holding companies: SAirLines, SAirServices, SAirLogistics, and SAirRelations. The former airline business unit became an operational subsidiary of SAirLines, but retained the name of Swissair Swiss Air Transport Company Limited (referred to as Swissair in this report). Likewise, the former aircraft maintenance business unit became a fully owned subsidiary of SAirServices and was named Swissair Technical Services Limited. Swissair Technical Services Limited became an autonomous company on 1 January 1997 known as SR Technics Group AG (referred to as SR Technics in this report).
At the time of the SR 111 occurrence, SR Technics had more than 3 000 employees and was responsible for aircraft maintenance for Swissair, which was its primary customer. SR Technics also performed maintenance for other SAirLines carriers and for third-party customers. Approximately 50 per cent of the total SR Technics work capacity was devoted to non-SAirGroup customers.
In April 2001, the parent holding company, SAirGroup, was renamed The Swissair Group. On 31 March 2002, Swissair ceased operations.
184.108.40.206 Swissair flight safety program
Swissair initiated a confidential reporting system in 1983; however, it was seldom used by the flight crews as a result of the establishment of a flight data analysis system that enabled the analysis of aircraft performance data. The information retrieved from the auxiliary data acquisition system (ADAS) was confidential and the analysis of this information was carried out by three selected Swissair pilots.
In each case, the Swissair analysts examined the data to determine how the aircraft was being flown, and to monitor any developing performance trends, such as out-of-tolerance flight parameters or deviations from standard operating procedures. As an example, they would monitor airspeeds to determine whether the speeds flown were within tolerances. The names of the pilots conducting the flights being analyzed were kept confidential. Only the relevant analysis was passed on to the Flight Safety department so that trends could be analyzed and addressed in newsletters or in simulator training. Each month a bulletin, entitled Incidents and Non-routine Occurrences, was published and distributed to the Swissair pilot community and also shared with other companies in the SAir Group. A quarterly safety letter, entitled Information Bulletin, was also distributed.
Pilot trust in this program was high. Each pilot at the company could request an analysis of the flights they had flown. It is estimated that at least 60 per cent of the case evaluations were pilot-requested.
220.127.116.11 Swissair postholder — Maintenance
Swissair was a scheduled airline operating under JAR-OPS 1 (see Section 1.17.2). As of 1 April 1998, Swissair was required, under JAR-OPS 1.175, to have nominated postholdersFootnote 84 to be responsible for the management and supervision of the following areas:
- Flight operations;
- Maintenance system;
- Crew training; and
- Ground operations.
JAR-OPS 1.895 required an operator to employ a person, or group of persons, to ensure that all maintenance was carried out on time, and to an approved standard. The individual, or senior person in the group as appropriate, was the nominated postholder.
Swissair nominated the head of Flight Operations Engineering and Support to be responsible for its Postholder-Maintenance System. This position was responsible for protecting the interests of the airline regarding all maintenance, manufacturing, and service provider issues, and for being the primary point-of-contact within Swissair for all its maintenance providers. Other responsibilities included ensuring that the aircraft were airworthy and that the operational and emergency equipment was serviceable.
The Swissair Postholder-Maintenance System was also responsible for conducting routine monitoring of the maintenance activities performed by SR Technics. Some of the areas that required monitoring responsibilities in the Swissair Maintenance Management Exposition included
- performing audits with qualified auditors;
- submitting a written report, indicating the findings, required actions, responsibilities and deadlines for actions;
- submitting a copy of the report to the Quality Manager;
- storing the report for five years; and
- monitoring the implementation of the actions taken, and their effectiveness.
18.104.22.168 SR technics quality assurance program
At the time of the accident, SR Technics had a valid JAR-145 Maintenance Organization Approval issued by the FOCA. The Quality Assurance (QA) program was established in accordance with JAR 145.65 and was based on the requirements of the Euro/International Standard EN 29001/ISO 9001. The QA program covered all organizational requirements and activities related to quality. The QA program was designed to ensure that all work performed, and services rendered, were done in accordance with SR Technics policies, procedures, and instructions, and with standard industry maintenance practices.
The QA program also ensured compliance with applicable regulatory requirements. QA within SR Technics, particularly the airworthiness of the aircraft and the use of aircraft parts, was the responsibility of the individual production units, in accordance with relevant job descriptions and procedures. SR Technics took a "Total Quality Management" approach to QA; that is, individual employees were expected to be responsible for the quality of their own work, and were required to perform a self-inspection after each "work step." Depending on the nature of the maintenance procedure, additional inspections were required in accordance with the SR Technics Maintenance Organization Exposition. Unit supervisors were responsible for ensuring that their personnel were sufficiently trained and equipped to perform the task at hand, and for inspecting the quality of their employees' work. Random quality inspections were also performed by members of the SR Technics quality department.
22.214.171.124 SR technics reliability program
At the time of the occurrence, a reliability program was in place at SR Technics to ensure airworthiness and a high level of reliability to optimize economic operations. The program existed under the umbrella of a joint reliability program. The program was known as KSSU because it included the following operators: KLM, SAS, Swissair, Union de Transport Aeriens, and later Air France. The program was designed for use when performing maintenance on aircraft from the Swissair fleet or other customer airlines. The total maintenance program was based on the FAA Advisory Circular (AC) 120-17A. The KSSU reliability program was published in the SR Technics Engineering Handbook, Technik, and was valid for all aircraft types operated by Swissair.
Overall, reliability of the airframe, engines, and aircraft systems was subject to continuous monitoring and analysis, as required by JAR-OPS 1 Subpart M.
1.17.2 Swiss Federal Office for Civil Aviation
The regulatory agency responsible for aviation oversightFootnote 85 in Switzerland is the FOCA, an office of the Federal Department of the Environment, Transport, Energy, and Communication. Switzerland is a member state of the JAA. The CAAs of certain European countries have agreed to common, comprehensive and detailed aviation requirements (referred to as JARs). JAR-OPS, Part 1, prescribes requirements applicable to the operation of any civil aircraft for the purpose of commercial air transportation by any operator whose principal place of business is in a JAA member state. The requirements in JAR-OPS, Part 1, became applicable for Swissair on 1 April 1998. No information was found to indicate that Swissair was not in compliance with the JARs at the time of the occurrence.
After 1 April 1998, the FOCA adopted the JAA philosophy that because of "increasing complexity and scale of both aircraft and commercial operations, the traditional spot checks undertaken by authorities no longer provide an intelligible or complete picture of any but the smallest operations."Footnote 86 Under the provisions of the JARs, the airline has a share of the responsibility for monitoring the quality of a safe service to the public. Important to the effectiveness of the policy is the JAR-OPS requirement for the establishment, by the operator, of a Quality System. This involves a designated Quality Manager and a nominated Accountable Manager; Swissair established such an organization.
Prior to the occurrence, the FOCA informally monitored Swissair operations, but did not conduct formal operational audits. The inspector responsible for monitoring Swissair was a former Airbus A310 captain. At the time of the occurrence, there were four operations inspectors within the Flight Operations Section of the FOCA, and all four had some dealings with Swissair.
Swissair flight operations were monitored by the FOCA through semi-annual coordination meetings, and by reviewing the daily flight operations report, flight safety reports, and crew reports of unusual incidents. The results of the Swissair Flight Operations QA program and ADAS analysis were also forwarded to the FOCA.
The responsibility for check rides was delegated to designated check pilots at Swissair; these rides were performed in accordance with the Quality System. Therefore, FOCA inspectors did not perform check rides on Swissair pilots, although they did periodically ride in the cockpit on scheduled Swissair flights to monitor in-flight operations. On the basis of their monitoring, the FOCA indicated no concerns about Swissair's flight operations.
1.17.3 Federal Aviation Administration
As the state of manufacture, the FAA was responsible for the original design approval of the MD-11 aircraft. The FAA accomplished this through a partnership process with the aircraft manufacturer, which resulted in the issuance of the type certificate number A22WE. After an aircraft is in service, the regulator provides management of the type certificate in a manner consistent with FAA policy and FAR requirements. The responsible Aircraft Certification Office maintains oversight by directly liaising with the type certificate holder on matters of continuing airworthiness.
1.17.4 The Boeing company
Boeing, and its predecessor McDonnell Douglas, as the holder of the MD-11 type certificate, is responsible for the continuing airworthiness activities associated with the MD-11 aircraft. These activities include the following:
- Completing the applicable Instructions for Continued Airworthiness (ICA);
- Participating in the Service Difficulty Reporting system as specified in 14 Code of Federal Regulations (CFR) 21.3;
- Providing necessary design changes to correct unsafe conditions as specified in 14 CFR 21.99; and
- Assisting in the development of ADs and coordination of safety issues with the appropriate FAA office.
1.18 Other relevant information
This section provides a variety of relevant information about the SR 111 occurrence that is not described in other sections of this report.
1.18.1 Swissair training
126.96.36.199 Flight crew
188.8.131.52.1 Aircraft training
Swissair pilots who transition to the MD-11 from other company aircraft were required to complete Swissair's standard six-week training course. The Swissair syllabus was adopted from the McDonnell Douglas, FAA-approved course. On these courses, captains and first officers were trained together, and there was a focus on the need to operate together as a crew.
As well as being trained to follow specific checklist procedures appropriate to the type of emergency, Swissair flight crews were trained to react to an emergency situation according to the following philosophy: Power, Performance, Analysis, Action. This sequence was designed to ensure the aircraft is configured appropriately, the situation is properly assessed from all perspectives, proper priorities are established, and appropriate outside resources are used as necessary.
184.108.40.206.2 Smoke/fumes/fire training
During the Swissair standard six-week pilot training course for transitioning to the MD-11, procedures for smoke/fumes/fire were covered in classroom discussions and in simulator training. Pilots were instructed to don their full-face oxygen masks at the first sign of smoke because of the danger of inhaling toxic fumes. Donning the oxygen masks was considered a memory item; therefore, it was not included as an item in the written checklist. The decision about whether to commence an emergency descent was considered a flight crew judgment call based on their perception of the threat. Initiating an emergency descent was also considered a memory item and was not included in the written checklist.
The flight crews were taught to evaluate any emergency situation before starting a checklist. For smoke/fumes events, flight crews were taught that unless they were certain that the source of smoke/fumes was the air conditioning system, they were to use the Smoke/Fumes of Unknown Origin checklist (see Appendix C–Swissair Smoke/Fumes of Unknown Origin Checklist). If flight crews were certain that the source of smoke/fumes was the air conditioning system, they could use the Air Conditioning Smoke checklist (see Appendix B–Swissair Air Conditioning Smoke Checklist).
A decision about whether to initiate a diversion for a precautionary or emergency landing was to be based on best judgment, with consideration given to the nature of the perceived threat. The company General/Basics Flight Crew Manual stated the following:
If a flight cannot be made to the regular destination, a diversion must be made to the most suitable alternate aerodrome providing the best available operational and passenger handling service.
To best meet this stipulation, the first choice would be an airport with a Swissair or contracted handling agent, such as Boston. Halifax was also a suitable, approved en route airport for the diversion of Swissair MD-11s.
The General/Basics manual also stipulated the various conditions that would require the flight crew to land at the nearest emergency aerodrome. These conditions included the following fire- or smoke-related scenarios:
- Any fire on board an aeroplane, including engine fire, if firefighting is not possible or ineffective; or
- Persistent smoke of unknown origin.
The General/Basics manual defined an emergency aerodrome in the following way:
Emergency aerodrome in this context means an aerodrome where a safe landing for the respective type of aeroplane in the configuration can be made, disregarding repair facilities, or passenger handling, etc.
At Swissair, and throughout the aviation industry, it was generally accepted that human sensory perception can be used to help differentiate between air conditioning and electrical smoke/fumes. For example, smoke/fumes from an electrical event would be expected to be acrid, and cause irritation to the eyes and respiratory tract. This information might be supplemented by looking for other potential clues about the source of the smoke, such as the colour, intensity, and the location from which the smoke/fumes are emanating, and any associated aircraft system anomalies.
The human sense of smell is the most rudimentary and least understood of all the human senses, and the experience of various smells is a subjective phenomenon. Although the threshold concentrations required to detect many substances through smell are low,Footnote 87 humans are generally not good at identifying the specific source of a smell.Footnote 88 Although ability to identify odours has been shown to be augmented by other characteristics of the source of the odour (e.g., irritation, acridity, pungence),Footnote 89 this is unlikely to assist a crew in distinguishing between different types of smoke that are quite similar in this regard. In addition, an individual's ability to discriminate between odours has been shown to be affected by attentiveness, temporary medical states such as congestion, and temporary physical states such as hunger.Footnote 90 The odour and smoke that appeared in the SR 111 cockpit consisted of the by-products of combustion, but the limited cues available were perceived by the pilots as pointing to an air conditioning source.
Training for the use of the Smoke/Fumes of Unknown Origin Checklist was conducted in the simulator. During MD-11 transition training, all three positions of the SMOKE ELEC/AIR selector are exercised. Flight crews were required to examine which aircraft systems were and were not available at each selector position. Flight crews were instructed that it takes about five minutes to exchange 100 per cent of the air in the aircraft. This was intended to provide guidance regarding how long it might take to assess whether the selection of a particular position was leading to the dissipation of the smoke/fumes. The information about the air exchange time was not written in any manuals or checklists, including those supplied by the manufacturer.
One simulator training session involved a scenario in which a "smoke of unknown origin" emergency occurred on take-off. The flight crew was expected to follow the Smoke/Fumes of Unknown Origin Checklist and to use the SMOKE ELEC/AIR selector. To save simulator time, the simulated smoke was terminated when the pilots selected the first position of the selector. As was the industry norm, there was no simulator training for an ongoing fire. Therefore, the pilots were not exposed to the combination of fire-related effects, such as a deteriorating cockpit environment with decreased instrumentation. The same simulator session also included an uncontrolled cargo fire scenario. The flight crews were expected to complete an emergency descent, followed by a landing and evacuation.
No specific training was provided for locating and suppressing fires in the cockpit or avionics compartment. Such training was not required by regulations, nor was it common industry practice to provide it.
No specific training was provided on flying the aircraft using only the standby instruments; there is also no regulatory requirement for such training. Several operators of transport category aircraft were canvassed to determine whether they provided this training to their pilots; none did.
Consistent with industry norms, there was no specific training on the location of potential flammable material in the aircraft, specifically in the hidden areas. The absence of such training reflected the lack of knowledge within the industry about the presence of materials used in the construction of the aircraft that, although certified for use, could be ignited and propagate flame.
220.127.116.11.3 Back-course approaches
Although the FMS database in the MD-11 does not store approach guidance information for back-course approaches, this would not have precluded the SR 111 pilots from conducting a back-course instrument approach using autopilot tracking methods, or conducting an NDB approach to Runway 06 for which data is stored in the MD-11 FMS database.
Because Swissair crews flew scheduled flights into airports equipped with back-course approaches, procedures existed, and flight crews were trained, for conducting non-FMS back-course approaches. Swissair MD-11 flight crews are trained, as part of their simulator training program, to conduct back-course approaches into Dorval Airport in Montréal, Quebec. The first officer had received this training within the previous six months; the captain, being a qualified simulator instructor, was also familiar with back-course approaches.
To conduct any approach, the pilots would want to know detailed approach procedure information, which is normally obtained from a hard-copy approach chart. Alternatively, if the situation warranted, sufficient partial information could also be obtained by asking the ATS controller for specific information. When flying a back-course approach in the MD-11, the autopilot can be used to fly the approach in the track mode; however, the pilots use track mode and heading mode constantly in training and in line operations. Therefore, flying a back-course approach would require more flight crew input and constitute a higher crew workload than is involved in conducting FMS-directed instrument approaches for which information is provided in the MD-11 FMC database. Some MD-11 operators have decided not to establish procedures for back-course approaches.
18.104.22.168.4 Fuel dumping
One simulator training session included an engine fire scenario that involved fuel dumping. As is normal industry practice, Swissair instructs its pilots that fuel dumping can be handled in two ways depending on the urgency: if the aircraft is in an emergency situation, fuel dumping can be initiated immediately and continued until shortly before landing; or if the situation and time permits, the aircraft can be flown to a designated fuel dumping area.
22.214.171.124 Flight attendant training
All of the flight attendants on board SR 111 were trained in accordance with the approved Swissair training requirements that were based on, and in accordance with, the JAR OPS. This training included initial and recurrent training on firefighting. The syllabus for the training included the importance of identifying the source of a fire, location and handling of firefighting equipment, communicating with the cockpit, firefighting responsibilities, and proper techniques for firefighting including use of fire extinguishers.
There was no specific training regarding firefighting in the attic area, nor was there any training specific to accessing other areas within the pressurized portions of the aircraft that are not readily accessible. There was also no specific training provided to the cabin crew about fighting a fire in the cockpit. This was consistent with government regulations and industry standards.
126.96.36.199 Human factors training
Swissair provided human factors training, commonly referred to as cockpit (or crew) resource management (CRM), to flight crew and cabin crew. The training for the flight crew consisted of a biennial, two-day course. The cabin crew received a two-day course as part of the initial cabin crew training program; then during the yearly cabin crew recurrent training, one and a half hours were reserved for CRM. Prior to 1997, this course was taught separately to flight crews and cabin crews. In 1997, Swissair began including the M/C in the flight crew training for one of the days. Course topics include the following:
- Conflict resolution; and
- Behaviour in emergencies.
In addition to the formal human factors training flight crews receive, Swissair employs a staff psychologist who is available for both flight and cabin crew to deal with personal matters or for any additional human factors information.
1.18.2 Swissair checklists for in-flight firefighting
For emergency procedures, each pilot had available in the cockpit, a book of checklists entitled Emergency Checklist Alert and Non-alert. The following three flight crew checklists dealt specifically with smoke or fumes:
- Air Conditioning Smoke (see Appendix B–Swissair Air Conditioning Smoke Checklist);
- Smoke/Fumes of Unknown Origin (see Appendix C–Swissair Smoke/Fumes of Unknown Origin Checklist); and
- Smoke/Fumes Removal.
For smoke and fire emergencies, checklist procedures were available for the cabin crew in the Cabin Emergency Preparation/Evacuation Checklist. These procedures were entitled "Smoke On Board" and "Fire On Board."
188.8.131.52 Flight crew smoke/fumes checklists
The MD-11 was certified with the following three flight crew checklists for identifying and dealing with smoke/fumes: Air Conditioning Smoke; Smoke/Fumes of Unknown Origin; and Smoke/Fumes Removal. The aircraft manufacturer recommended that the Air Conditioning Smoke checklist be used only when a flight crew was certain that the air conditioning system was the source of smoke or fumes.
In March 1993, the aircraft manufacturer removed the Air Conditioning Smoke Checklist from the Flight Crew Operating Manual (FCOM), although it was retained in the FAA-approved Airplane Flight Manual (AFM). The Smoke/Fumes of Unknown Origin Checklist was renamed to the Smoke/Fumes of Electrical, Air Conditioning, or Unknown Origin Checklist. The amendment was based on the logic that the same steps were included in the Smoke/Fumes of Unknown Origin Checklist; therefore, regardless of the source, the same action items could be used to attempt to isolate the source of the smoke/fumes.
Swissair developed its MD-11 checklists based on the FAA-approved AFM. When the aircraft manufacturer reduced to one smoke/fumes checklist in the FCOM, some airline operators including Swissair, decided to keep the two separate checklists. The Swissair decision to keep the two checklists was based on the view that if a flight crew could determine, with 100 per cent certainty, that the air conditioning system was the source of smoke/fumes, the Air Conditioning Smoke checklist would be used and there would be no associated disruption to the aircraft electrical system. Swissair considered this to be the safest alternative, because when the Smoke/Fumes of Unknown Origin Checklist is actioned, electrical power and pneumatics are removed from a number of services (see Appendix C), making it more demanding to fly the aircraft.
184.108.40.206 Swissair MD-11 checklist design
220.127.116.11.1 Philosophy and methodology
The source document for MD-11 checklists used by Swissair crews is the Swissair MD-11 AOM. This manual, developed by Swissair, describes the MD-11 aircraft systems and normal, abnormal, and emergency operating procedures. The AOM was derived from the FAA-approved AFM, the McDonnell Douglas MD-11 FCOM and Swissair's company policies. Revisions to the AOM were issued to manual holders as required from time to time and distributed by means of a consecutively numbered "Transmittal Letter." AOM bulletins were periodically published to inform manual holders of technical/operational matters related to the AOM including checklist revisions. The AOM and revisions were submitted to the FOCA for review; checklist revisions are not required by the JARs to be approved by the FOCA. AOM bulletins are submitted to the FOCA for information only.
Swissair's checklist design philosophy considered ease of use, accessibility, brevity, and similarity in groupings. Checklists were to be designed to be simple in presentation, especially those pertaining to emergency situations, and were to be quickly and easily accessible by the flight crew. Each procedure, from start to finish, was to be designed to be contained on one page; procedures having common themes were grouped together.
Swissair maintained a close relationship with the manufacturer concerning checklist design. They met regularly to discuss such matters as potential checklist changes and problems noted with checklist usage during simulator sessions; however, the manufacturer does not approve the checklists used by the operators.
18.104.22.168.2 Comparison with guidelines
An FAA document entitled Human Performance Considerations in the Use and Design of Aircraft Checklists was published in 1995 to assist FAR Part 121 and 135 operators in the design, development, and use of cockpit checklists, and to increase their awareness of human performance issues relating to checklist usage. The CAA in the United Kingdom has a similar set of guidelines, entitled Guidelines for the Design and Presentation of Emergency and Abnormal Checklists.
Although these guidelines were not in effect during the MD-11 design period, they were available for reference during ongoing checklist modifications. As part of the SR 111 investigation, the guidelines were used to evaluate the Swissair emergency checklist dealing with smoke/fumes.
Deviations from the guidelines were noted. While the one-page principle is appropriate in general, its application for the Smoke/Fumes of Unknown Origin Checklist conflicted with other design principles. For example, attempts to condense this checklist onto one page led to the use of smaller-than-recommended font sizes in the notes section.
1.18.3 Availability of published approach charts
Published approach charts provide the flight crew with information, such as runway orientation, length and lighting, minimum safety altitudes and descent altitudes, names, identification letters and frequencies of navigation aids, radio frequencies, and headings to be flown. This information is used when entering the airspace surrounding an airport when conducting an instrument approach.
As with many operators, the Swissair procedure for the MD-11 was to carry a set of airport approach charts in a crew bag that was stored in the ship's library at the rear of the cockpit. It was not possible for either pilot to reach the bag while seated; therefore, a pilot would either have to leave the seat or request a cabin crew member to come forward to relocate the bag. In a normal situation, little risk is associated with these options; however, in an abnormal or emergency situation, this extra task constitutes a distraction that can cost valuable time.
1.18.4 Wire-related issues
22.214.171.124 Wire separation issues
In the MD-11, the overhead CB panel contains six electrical buses that supply power to many of the aircraft's systems: four emergency buses, the battery bus, and the battery direct bus. The battery direct and the battery bus feeds are routed together, making five separate cable runs into the cockpit overhead panel from the avionics compartment. The five cable runs are spatially separated from each other until they reach an area approximately 31 to 46 cm (12 to 18 inches) aft of the housing that is located behind the overhead CB panel. They are then bundled together and enter the overhead CB panel through an oval opening on the right aft side of the housing.
One of the emergency bus feed power cables found in the wreckage, identified as a section of the left emergency AC bus feed, exhibited an area of melted copper consistent with an arcing event in a location between 10 and 15 cm (3.9 and 5.9 inches) outside the housing. This particular cable was insulated with BXS7008, a XL-ETFE type insulation, whereas the remaining cables were constructed from BXS7007, a polyimide-wrapped film and a meta-aramid fibre paper outer cover. This general area above the cockpit had experienced heat damage from the in-flight fire. Other wires from the same general location, but in a different wire bundle, were also found to have arced. As indicated in Section 1.18.8 of this report, the known sequence of events does not support the hypothesis that the arcing of the wires in this area was related to the initiating event. That is, the arcing in this area took place later in the failure sequence and was the result of fire-related heat damage to the wires.
The left emergency AC bus lost power shortly before the flight recorders stopped recording. It is unknown whether any or all of the remaining emergency or battery buses were eventually affected, but it is known that none of them were affected at the same time as the left emergency AC bus. However, because the cables were brought into such close proximity in the overhead panel housing area, they would all have been exposed to the same threat, such as heat, fire or arcing event.
126.96.36.199.2 Consequences of a total loss of electrical power to the overhead panel
It could not be determined whether power sources other than the left emergency AC bus were lost to the overhead panel; however, an assessment was completed to determine the effect on aircraft systems if a total loss of electrical power occurred. Because it was known that primary electrical power was still available until the time of impact, the assessment focused on determining what functions would remain available from primary power sources to provide basic information, such as attitude, altitude, airspeed, and heading. The primary flight controls do not require any electrical power to operate and so were not part of this assessment.
DU 2 would remain powered from primary power and would be reconfigured to a PFD with DEU 3 providing the inputs. The PFD would provide attitude and heading information. Altitude and airspeed would be available from the standby instrument. Engine control would be available, but no engine and alert status information would be available. All radio communication would be lost. Numerous other warning lights, such as the master warning and caution lights, would not be functional.
188.8.131.52.3 Regulatory requirements
The MD-11 wire installation design was assessed as part of the investigation to determine whether it met the regulatory requirements for wire separation, and whether there were any associated safety deficiencies.
The following FARs relate to wire separation and routing:
- FAR 25.1309(b) states that failure analysis must consider that "no single failure shall prevent safe flight and landing";
- FAR 25.903(d) states that turbine engine installation design must minimize hazards to wires in case of rotor failure;
- FAR 25.631 requires that wiring, necessary for continued safe flight and landing, must be protected against a bird strike hazard; and
- FAR 25.1353(b) deals with the separation of essential system wiring and heavy current-carrying cables.
Specifically, this assessment focused on the area where the power cables are bundled together just before they enter into the overhead switch panel housing. This bundle was in close proximity to hundreds of other circuit wires that were also bundled together as they entered or exited the housing. When assessing the MD-11 overhead panel housing area, the most relevant regulation is FAR 25.1353(b), which states "Cables must be grouped, routed and spaced so that damage to essential circuits will be minimized if there are faults in heavy current-carrying cables." This requirement calls for the spatial separation of cables to avoid damage to essential circuits. Essential loads, as defined by the MD-11 manufacturer, are those that are essential to maintain controlled flight in zero visibility.Footnote 91 The regulation requires that a potential threat be minimized; it does not require that a potential threat be eliminated. The term "minimized" is not defined; however, according to the FAA, the term has an element of reasonableness associated with it.
To meet the requirement of FAR 25.1353(b), the electrical cables in the MD-11 that run to the overhead panel are spatially separated from each other until they enter the overhead panel housing. Once the cables were positioned together, spatial separation no longer existed. To minimize the risk of wire insulation chafing, the manufacturer fitted the edge of the oval opening in the housing with a nylon grommet. For added mechanical protection, the cables that are between 8 AWG and 00 AWG in size are protected by an extra (third) wrap of polyimide insulation, plus an outer jacket (meta-aramid fibre paper). The wires between 24 AWG and 10 AWG have two wraps of polyimide insulation. The three right emergency AC bus cables were also wrapped in a silicone elastomer-coated glass fibre braided electrical sleeving to provide additional protection. The additional mechanical protection provided on the cables in the bundled area met the FAA's interpretation of minimization and reasonableness. Because of the lack of specific quantitative information in the guidance material, it could not be determined what criteria was used to determine the level of mechanical protection needed to satisfy the requirements of FAR 25.1353(b) for situations where adequate spatial separation is impracticable.
The design of the MD-11 wire routing into the overhead switch panel housing was based on the design used in the DC-10. The service histories of both aircraft were reviewed to determine whether any problems, such as chafing, were reported; none were found.
184.108.40.206.4 Mixing of wire insulations
The predominant general wire insulation used on the occurrence aircraft was the MIL-W-81381, polyimide-film-type wire insulation. However, other types of insulations were also used depending upon requirements. Wires with these different insulation types were sometimes routed in the same wire bundles. While there are no regulations pertaining to the mixing of wire insulations with dissimilar properties, FAA ACs 25-16 and 43.13-1B provide guidance. These guidelines rely on the aircraft manufacturer or subsequent modifier to establish the compatibility of various wire insulation materials through satisfactory in-service performance history, additional tests, or both.
When the DC-10 entered revenue service over 25 years ago, some problems were encountered with the premature failure of clamps and wires at clamping points in areas of high vibration (pylons, wing, and tail engine). The MD-11 manufacturer developed a wire compatibility test procedure to represent the most severe vibration environment on the aircraft that replicated the failures experienced on in-service aircraft. Testing allowed the MD-11 manufacturer to assess the compatibility of various wire insulations, to evaluate new wire insulation types, and to develop containment parts (clamps, nylon tie-wraps, etc.) and materials including protective sleeving and tubing. The MD-11 manufacturer advises that high vibration and wire-to-wire abrasion testing has shown that, when properly installed, the mixing of different approved insulation types has not been a problem.Footnote 92 Typically, it was found that the wear patterns are similar regardless of whether there is a mix of insulations. The wire compatibility test developed by the MD-11 manufacturer has become their standard for evaluating and developing new wire insulation types, containment parts and materials, and protective sleeving and tubing. In addition, the FAA has indicated that there is no systemic problem associated with the use of mixed wire types that are properly installed and maintained.
1.18.5 Circuit protection devices
A regulatory requirement exists that electrical wires and cables be protected from an over-current condition.Footnote 93 Typically, a circuit protection device (CPD) is used to provide this defence. CPDs are designed to protect the wire or cable; that is, they are not designed to protect the associated electrical components, such as line replaceable units (LRU), which may require their own internal CPDs.
220.127.116.11 Circuit breaker design
The majority of CPDs used in aerospace applications are the resettable thermal CB type developed as a replacement for fuses. These conventional CBs typically contain a circuit consisting of a bimetallic element and two electrical contacts, one of which is spring-loaded. When an over-current condition occurs, the circuit heats as a function of current flow and time. When the heat exceeds a preset amount, the bimetallic element bends causing the spring-loaded contact to trip and open the circuit. The design is known as a "trip-free" CB in that it cannot be reset in the presence of an over-current condition. After a predetermined interval for cooling, the CB is capable of being manually reset.
This type of CB has proven to be effective in accomplishing its primary role, which is to protect wire and cable from damage owing to an over-current condition. Specifically, this type of CB successfully protects the circuit when the temperature and time duration characteristics of the over-current condition are within the CB's design limits.
However, some types of wire and cable failures involve arc faults. Arc faults can create circumstances that do not fall within the design limits of the over-current/time protection curve of conventional CBs. One such phenomenon is an intermittent metal-to-metal event (conductor-to-conductor or conductor-to-frame) known as a "ticking fault." Such events can generate extremely high temperatures at the location of the insulation failure; however, the current draw may not be sufficient to heat the bimetal element to the temperature necessary to cause the CB to trip. In some cases, a breakdown of wire insulation can lead to other types of arc fault failures, such as arc tracking. The arc-tracking phenomenon involves carbonization of the wire insulation material that can result in intermittent arc faults between conductors, the aircraft frame, or other grounded conducting material.
Although the hazards created by ticking faults and electrical arc tracking are widely known, existing technology is such that there are no CPDs available for use in aircraft that can accurately and reliably detect faults associated with wire insulation breakdown. The USN, the FAA, and aircraft manufacturers are sponsoring initiatives to address this shortfall in CPD technology. The goal is to develop an arc fault circuit breaker device appropriate for aircraft use.
18.104.22.168 Circuit breaker reset philosophy
Inconsistencies exist within the aviation industry regarding CB reset philosophies, which have resulted in the evolution of inappropriate CB reset practices. For example, there is a widely held view among flight crew and maintenance personnel that one reset of any tripped CB is acceptable. Consequently, often the first step in troubleshooting a tripped CB was a reset attempt. There is also a view that the reset of a low ampere CB is less dangerous than the reset of a higher ampere CB. However, while the consequences of resetting a low ampere CB may be less pronounced, under the correct conditions an arcing event involving a low ampere circuit could readily ignite a fire. Since it is impossible to know whether these conditions exist in any given situation, a tripped CB should not be reset before any associated fault is located and eliminated.
The adverse consequences of a CB reset may not be universally well understood within the aviation industry. An inappropriate reset can exacerbate the consequences of the initial fault and lead to an arc or arc-tracking event; however, there is no clear regulatory direction to the industry on the issue of CB resets. In AC 25.16, the FAA recommends that all AFMs should contain guidance that states the following:
The crew should make only one attempt to restore an automatically-disconnected power source or reset or replace an automatically-disconnected CPD that affects flight operations or safety.
Precisely what action is expected from this statement is open to interpretation. In addition, there is no regulatory requirement that the AFMs are to inform flight crews of the adverse consequences of CB resets, or to state categorically that no resets are allowed except for a single reset of those systems deemed by the pilot-in-command to be flight essential.
Likewise, the FAA guidance material for maintenance personnel does not address the issue of resetting of tripped CBs. The FAA AC 43.13-1B does refer to the SAE Aerospace Recommended Practice (ARP) 1199, which deals with over-current protective devices. This ARP does not specifically discuss the immediate consequences of resetting CBs; however, it does advise that CBs should not be allowed to develop a "history of tripping."
In 1999, the major aircraft manufacturers summarized their existing CB reset policies by issuing statements to all operators that give clear and unambiguous direction concerning CB resets. However, operators are under no obligation to act on manufacturer recommendations; they are only required to act on requirements imposed by regulators.
Subsequently, on 21 August 2000, the FAA issued a Joint Flight Standards Information Bulletin entitled Resetting Tripped Circuit Breakers in an effort to standardize the industry's approach to this issue. The goal of the bulletin was to ensure that air carriers had training programs and manuals in place for flight crews, maintenance personnel, and aircraft ground servicing personnel, and that these programs and manuals contained company policies and procedures for resetting tripped CBs that reflected the FAA's position on this issue. This bulletin was only applicable to air carriers in scheduled operation, with aircraft having a passenger-seat configuration of 10 or more seats, or a payload capacity of more than 7 500 lb. This bulletin's expiration date was 31 October 2001.
22.214.171.124 Circuit breakers used as switches
The use of CBs as switches, either by design, or as a consequence of the system's in-service performance, is not recommended. The FAA guidance on this issue is contained in AC 43.13-1B and states "Circuit breakers...are not recommended for use as switches. Use of the circuit breaker as a switch will decrease the life of the circuit breaker."
SAE ARP 1199 expands on the guidance:
- CBs are designed for a different purpose and have a life of 1/10th or less of the life of a switch;
- CBs are not to be considered substitutes for switches;
- Excessive manual operation of a CB can cause dynamic wear of the breaker latching areas and pivotal points; and
- Using a CB as a switch can cause its contacts to arc, thereby pitting the contacts and generating EMI.
As there are no regulatory restrictions preventing the use of CBs as switches, it appears that this guidance is provided as a means to enhance system reliability as opposed to establishing the minimum requirements for system safety.
As certified, and installed on the occurrence aircraft, the original IFEN system design did not incorporate an ON/OFF master switch. The ON/OFF capability was achieved by the installation of the 28 V DC Interactive Flight Technologies (IFT)/video entertainment system 28 V CB. Although it was determined that this configuration was not related to the initiation of the fire, it did have the potential to be problematic, as suggested in the guidance material in the SAE ARP 1199. As modern aircraft use more software-based equipment, it is not uncommon for systems to be designed in this manner. CBs are being used more frequently as switches, as they are viewed as a convenient method of "rebooting" the system when the software gets "hung up."
Although no particular unsafe conditions were validated during the investigation regarding the use of CBs as switches, questions remain concerning the practice, including the potential for frequent "switching" to induce a change in the physical properties of the CB so as to alter its reaction time in the face of an over-current condition. The routine use of a CB as a switch also has the potential to influence an individual's perception about the actual use and function of a CB.
126.96.36.199 Circuit breaker maintenance
The CB is known in the aviation community to be a simple, long lasting, and reliable component that is designed to provide protection for the aircraft's wires and cables throughout the life of the aircraft. Due in part to its dependability, CB maintenance is usually confined to the replacement of a failed CB.
Typical CB failure modes include welding, erosion of electrical contacts, and contamination.
In addition, the mechanical characteristics of the CB will change when a CB trip mechanism has been inactive for long periods. Such changes could lead to inappropriate performance during an over-current condition, resulting in inadequate protection of the circuit. Routine inspections, including the unpowered cycling of the CB mechanism, can be useful in ensuring the reliability of a CB. Such cycling serves to enhance CB performance by "exercising" the CB trip mechanism and cleaning contaminants from the contact surfaces. Both the FAA and SAE recommend this practice to enhance CB reliability.Footnote 94
1.18.6 High-intensity radiated fields
Modern aircraft transmit and receive RF signals in the atmosphere external to the aircraft. In addition, RF signals are conducted and radiated within the aircraft, through electrical cabling, to control and communicate with various electronic systems. High-intensity radiated fields (HIRF), produced by powerful radar transmitters or lightning, will partially penetrate a commercial aircraft through apertures in the aircraft's hull.Footnote 95 HIRF may couple onto cabling within the aircraft structure and distort or corrupt the signals carried on these cables, thereby disrupting the normal functions of the associated aircraft systems. In addition, if the HIRF gradient within the pressurized area of the aircraft exceeds 23 kilovolts per centimetre, an electrical discharge may be induced between narrowly separated conductors.Footnote 96 In this latter case, physical damage to electrical components may occur and flammable materials in the surrounding area may ignite. The HIRF environment in the vicinity of the occurrence aircraft was studied to determine whether the ambient field strength was sufficient to produce such an effect.
188.8.131.52 JFK international airport environment
An assessment of the HIRF environment at JFK International Airport was derived from a 1998 studyFootnote 97 of the peak and average field intensities to which aircraft operating in US civil airspace could be exposed. During normal approach and departure operations in the airspace on and around airports, a peak field strength of 3 kilovolts per metre can occur in the 2 to 6 gigahertz (GHz) frequency band.
184.108.40.206 En route environment
For the en route portion of the occurrence flight, the most significant known HIRF environment was produced by an AN/FPS-117 air route surveillance radar, located near Barrington, Nova Scotia. At 0109, the occurrence aircraft passed within 10 nm of this radar site at an elevation angle of approximately 30 degrees from the horizontal. A maximum field strength of 20 volts per minute (V/m) can be produced by the Barrington radar, at a slant range of approximately 10.5 nm. However, because this radar is optimized to achieve optimum gain at relatively low elevation angles, a field strength of approximately 4.3 V/m was produced by the Barrington radar in the external environment surrounding the occurrence aircraft. A maximum combined field strength of approximately 12.1 V/m was produced by the Barrington radar and all other background emitters in the external environment surrounding the occurrence aircraft.
220.127.116.11 Theoretical worst-case HIRF environment
An estimate of the most severe HIRF environment, during any phase of flight, was developed for airspace where fixed-wing commercial operations are permitted. Field strengths were calculated for surface emitters and airborne intercept radars, operating at the minimum separation distances permitted under instrument flight rules. Mobile and experimental transmitters, and transmitters located inside restricted, prohibited, and danger areas, were not considered. This methodology produced a worst-case peak field strength of 7 200 V/m, which is assessed to occur in the 4 to 6 GHz frequency band.
18.104.22.168 MD-11 HIRF certification environment
The MD-11 aircraft certification was subject to special HIRF test conditions imposed by the FAA and the JAA. Test procedures were specified for the MD-11 to demonstrate an acceptable level of aircraft systems protection from the effects of HIRF. The MD-11 HIRF test environment was more stringent than the HIRF certification guidance that currently exists for new aircraft, and exceeded the theoretical worst-case environment. For example, in the 4 to 6 GHz band, where the highest theoretical field strengths are assessed to exist, the MD-11 test condition specified a peak field strength of 14 500 V/m, about double the peak field strength of the theoretical worst case. In the 1 to 2 GHz frequency band, where the Barrington radar operates, the MD-11 test condition specified a peak field strength of 9 000 V/m.
22.214.171.124 Effect of HIRF on VHF communications
Aircraft antennas are designed to receive RF signal energy in specific frequency ranges and to conduct this RF energy to the radio or radar receivers in the aircraft. Aircraft radios are designed for operation at frequencies assigned in accordance with national and international RF spectrum allocations. These RF spectrum allocations are developed to ensure that authorized high-power RF sources will not interfere with aircraft radios and radars. If a HIRF source were to operate within the assigned frequency range for an aircraft radio, the HIRF energy within the frequency range to which the radio receiver was tuned would be demodulated and amplified, adversely affecting VHF communications. However, modern radio receivers are designed to prevent radio signals from being amplified to unsafe power levels. In general, there is no relationship between the degradation or disruption of VHF communications owing to EMI, and the presence of field strengths sufficient to induce an electrical discharge between proximate conductors. The service record for Douglas commercial aeroplanes does not contain any instances of HIRF-induced degradation or disruption of VHF communications, or the presence of field strengths sufficient to induce electrical discharges between proximate conductors.
126.96.36.199 Effect of resonance on HIRF energy
When a travelling wave is reflected back upon itself, the incident and reflected wave energy may combine to form a spatially stationary, reinforced wave. For an electromagnetic waveform, such as HIRFs, reinforced wave phenomena or resonance can occur in closed cavities, along a length of wire or around the perimeter of an aperture. When resonant conditions exist, the energy density of the reinforced wave may be up to 25 times greater than the energy density of the incident wave. In practice, resonant gain factors rarely exceed a single order of magnitude.
1.18.7 In-flight entertainment network
In May 1996, Swissair entered into an agreement with IFT to install a then state-of-the-art IFEN system into 16 MD-11 and 5 B-747 Swissair aircraft. The installations were to be completed under the authority of Switzerland's FOCA, and in accordance with the FAA STC ST00236LA-D
188.8.131.52 IFEN installation–Roles and responsibilities
In the agreement made with Swissair, IFT was responsible for all aspects of integrating the IFEN system into all Swissair MD-11 and B-747 aircraft, including the system-to-aircraft integration design, system certification, hardware installation, ongoing support, training, and continuing airworthiness.
IFT specialized in the design and manufacture of the IFEN system components. To complete the installation project, IFT required the services of others who had expertise in integrating an IFEN into an aircraft design, certifying the system, and installing the system components into the aircraft.
IFT entered into an agreement with HI to perform the IFEN certification, system-to-aircraft integration engineering, and aircraft installation functions. These subcontracted aspects included the development of all necessary engineering drawings and documents and the manufacturing of wire bundles, equipment racks, and structural supports. Under the contract HI was responsible for the hardware installation of the system into all Swissair MD-11 and B-747 aircraft. The installation work was to be done at SR Technics facilities in Zurich, Switzerland.Footnote 98
HI entered into an agreement with Santa Barbara Aerospace (SBA) to perform the FAA certification services, in its capacity as an FAA-approved Designated Alteration Station (DAS). By agreement with HI and IFT, SBA became the owner of STC ST00236LA-D and became responsible for complying with all regulatory requirements, including continued airworthiness.
In certifying the STC, SBA had been delegated the authority (by the FAA) to act on behalf of the FAA. FAA procedures required that a DAS submit a Letter of Intent (LOI) for each STC project, describing the project in sufficient detail to allow the FAA to determine what level of FAA involvement and oversight would be appropriate.Footnote 99
The Swiss FOCA accepted that an FAA-approved STC could be used for the project. Its acceptance was based on the installation work being accomplished by HI personnel and performed under the provisions of the European JAR 145-approved QA program at SR Technics. In addition, HI was required to submit FAA Form 337Footnote 100 to SR Technics, documenting that the system was installed in accordance with the certification requirements of STC ST00236LA-D, and the FAR, Part 43. The Swiss FOCA did not assume any direct responsibility for authorizing or overseeing the IFEN installation project.
SR Technics' function in the Swissair IFEN project was governed by its contract with Swissair, known as the "September 1996 Offer," and by its responsibilities in accordance with its role as the JAR 145 maintenance provider for Swissair's MD-11 fleet. IFT, through its subcontractor HI, was responsible for the design and installation of Swissair's MD-11 IFEN system. SR Technics was responsible for providing logistical support, technical data, and assistance on an "as requested" basis, and for performing the QA on each of the MD-11 IFEN installations in accordance with its JAR 145 obligations. SR Technics was not responsible for reviewing or approving the design and certification of the IFEN system.
184.108.40.206 SBA's letter of intent–FAA review
The FAA received the LOI for the Swissair project from SBA on 23 August 1996, and in accordance with established procedures, assigned an FAA team to review the LOI to determine the appropriate level of FAA involvement. In addition to certification engineers, the team consisted of personnel from the Manufacturing Inspection District Office and the Aircraft Evaluation Group (AEG). The AEG's responsibilities include determining the operational suitability of newly certified or modified aircraft, and unlike the other FAA certification responsibilities, which are delegated, the AEG's responsibilities are not part of the DAS's delegated authority.Footnote 101
The LOI described the IFEN as a "non-essential, non-required passenger entertainment" system. SBA conducted a qualitative system safety analysis in accordance with FAR 25.1309, which concluded that no single failure or latent multiple failure of the system would affect the ability of the aircraft to continue safe flight and landing, significantly increase flight crew workload, or require unusual strength. The LOI also stated that there would be no changes to the pilot or co-pilot panels.Footnote 10
Following their initial review of the LOI, the FAA contacted SBA to advise them of two additional test requirements necessary to certify the IFEN system. The first test involved assessing the crashworthiness of the associated new seat trays; the second involved assessing the flammability of IFEN-related materials being added within the cabin. On 3 October 1996, SBA submitted an amended LOI to the FAA incorporating the additional test requirements. The initial LOI was stamped "FAA Accepted" on 8 October 1996.
Based on the proposed IFEN system as described in the LOI, the FAA determined that SBA was capable of conducting the STC approval process. The FAA expected that SBA would inform them of any subsequent changes to the scope of the project, and that SBA would request FAA expertise as required. Other than those mentioned above, SBA did not submit any written changes to the LOI as the project evolved.
220.127.116.11 Evolution of the IFEN project under SBA
In completing its certification responsibilities, SBA was responsible for approving data supplied by HI, and for confirming that all aspects of the IFEN design and installation complied with the regulations. SBA was also responsible for witnessing tests, reviewing drawings, and checking for parts and installation conformity. SBA was not responsible for actual design or installation functions in support of the project. In addition, as a DAS, SBA had no certification responsibilities with respect to determining operational suitability.
The primary documents that were available for review by SBA were the drawings and supporting documentation identified in the master data lists and the ELAs produced by HI.
An earlier version of the ELA produced by HI, dated 18 August 1996, stated that electrical power for the IFEN would be supplied from the AC cabin bus distribution system, which could be manually shed during abnormal operations and automatically shed during emergency operations. There is no indication that SBA had access to the early version. Later versions of the ELA produced by HI indicate the power source, for the first- and business-class passenger sections, to be the 115 V AC Bus 2. The change in power supply followed the discovery by HI, in accordance with their analysis of the Swissair MD-11 electrical loads, that the cabin bus distribution system could not supply adequate electrical power to accommodate the full 257-seat IFEN configuration. The use of the 115 V AC Gen Bus 2 altered the intended function of the CABIN BUS switch, and the IFEN integration design did not identify the operational impact of this change. The change to the different power source was not reflected in the LOI submitted to the FAA, nor was a revised LOI submitted to the FAA.
The drawings used by SBA to approve the STC indicated that IFEN CBs were to be added to the lower avionics CB panel in the cockpit. The addition of the CBs into the cockpit was not reflected in the LOI submitted to the FAA.
The ELA work done at HI was completed by staff who had no experience with MD-11 aircraft. Neither SBA nor HI had staff members familiar with the MD-11 electrical design philosophy, which limited their ability to assess the compatibility of the IFEN integration with existing aircraft systems and with AOM checklist procedures. Wording in commercial contracts associated with the IFEN installation project suggested that other parties, including the operator, would be expected to participate in assessing the compatibility of the system-to-aircraft integration. The final ELA for the IFEN integration contained minor inaccuracies and was not provided to SR Technics until after the SR 111 accident.
18.104.22.168 IFEN integration–Electrical power supply
In the configuration that was certified, the IFEN was connected to aircraft power in a way that was incompatible with the MD-11 emergency electrical load-shedding design philosophy and was not compliant with the type certificate of the aircraft. The IFEN was powered from the 115 V AC Bus 2, an electrical bus that is not affected by the selection of the CABIN BUS switch.
The CABIN BUS switch was designed to permit removal of all electrical power from the aircraft cabin services, except for emergency services. The first item in the Swissair Smoke/Fumes of Unknown Origin Checklist is to select the CABIN BUS switch to the OFF position. The design of the IFEN system-to-aircraft power integration constituted a latent unsafe condition. However, as the fire was underway at the time the CABIN BUS switch was used (13 minutes, 7 seconds, after the initial smell was noted), no link was established between this latent unsafe condition and the initiation or propagation of the fire.
22.214.171.124 FAA oversight (Surveillance) of SBA
The FAA Los Angeles Aircraft Certification Office (LAACO) was responsible for regulatory oversight of SBA, which it accomplished by monitoring individual SBA DAS projects, and by conducting evaluations.
Although the FAA kept an administrative file on SBA, it was not normal business practice for the LAACO to keep records of their day-to-day contacts with SBA, or of their individual STC project monitoring activities. FAA files contained records of two formal evaluations of SBA, one in March 1996, and another in May 1998. Both of these evaluations contained findings of non-compliance with existing requirements; none of these findings were assessed by the FAA as being a threat to flight safety. The findings were described by the FAA as being "paperwork" related. The FAA was satisfied with the response of SBA to each of the evaluations. SBA was in compliance with all FAA requirements for a DAS at the time of the SR 111 occurrence.
Subsequent to the SR 111 occurrence, the FAA conducted a special certification review (SCR) of STC ST00236LA-D. Findings in the SCR point to shortcomings in both SBA's certification procedures and FAA monitoring of the project. On 30 November 1998, SBA relocated its operations to new facilities; regulations required that, because of the move, they must reapply for authority to continue as a DAS. At that time, SBA voluntarily surrendered its DAS certificate to the FAA. Subsequently, SBA became insolvent.
126.96.36.199 FAA aircraft evaluation group functions
Certain STC certification services are reserved for FAA approval and are therefore not delegated to a DAS. Such is the case for those certification services provided by the AEG.
Specifically, FAA Order 8110.4A indicates that the AEG should be involved in STC projects that affect operational suitability and ICA. Examples would include changes in crew requirements, flight instrument displays, and minimum equipment lists.
In the case of STC ST00236LA-D, SBA submitted an LOI that concluded that the IFEN was operationally suitable for use in the MD-11 aircraft. The AEG accepted this determination even though, as a DAS, SBA had not been delegated the authority to make such a determination.
188.8.131.52 Information provided to Swissair and SR technics
IFT provided technical training that focused on their approved servicing and maintenance activities to SR Technics maintenance personnel. Informal training was also available to Swissair aircraft crews to familiarize them with the operation of the IFEN system. As a result of frequent software-related problems, flight crews were informed through an AOM bulletin that, if necessary, they could use the 28 V DC IFEN CB on the lower avionics CB panel to shut down or reset the system. In the absence of a system ON/OFF switch, this procedure was meant to provide the flight crews with a means of dealing with routine IFEN anomalies. It is reasonable to expect that Swissair flight crews would have believed that if power needed to be disconnected from cabin services, the IFEN system, along with other cabin services, would be de-powered by turning off the CABIN BUS switch.
184.108.40.206 System design and analysis requirements
Compliance with FAR 25.1309 required that a system safety analysis be conducted on the IFEN system. Such analysis ranges from a qualitative assessment (e.g., a Functional Hazard Assessment), based on experienced engineering judgment, to a complex quantitative assessment (e.g., a Failure Modes Effects Analysis), which includes a numerical probability analysis. The FAA's AC 25.1309-1A introduced in 1988 does not differentiate between an "essential" or "non-essential" system but rather requires that failure analysis be performed on all aircraft systems. The IFEN system's functional criticality, assigned by SBA, was described as "non-essential, non-required."Footnote 103
While the FARs do not use or define the term "non-essential, non-required," it is commonly used in the aviation industry to describe a system whose failure will not affect the safe flight and landing of an aircraft. Entertainment systems are typically described as "non-essential, non-required," with assumptions made that any failures would have only a "minor" effect on aircraft operation. This categorization allows the system safety analysis to be accomplished by a qualitative assessment based on prior engineering judgment of similar systems, and on a history of satisfactory in-service experience.
220.127.116.11 Operating anomalies
In the two Swissair MD-11 aircraft that initially had the IFEN installed in all 257 seats, in warm atmospheric conditions, the operation of the IFEN system added sufficient heat to the cabin that it became difficult to keep the cabin cool. Flight crews were informed that if the cabin became too warm, they were to select the ECON switch to the OFF position; this action would provide colder air in the cabin. Then, if the cabin did not cool sufficiently after four hours of flight, the remedy was to shut down the IFEN by pulling the 28 V DC IFEN CB on the lower avionics CB panel. The occurrence aircraft logbook had no record of any cabin temperature issues related to the IFEN installation. This temperature control problem was resolved when the IFEN was reduced to the 61-seat configuration and was not relevant to the occurrence aircraft.
18.104.22.168 IFEN maintenance history
IFEN maintenance records for the Swissair fleet were reviewed to find possible failures in wires or electrical components. Two instances of PSU failures were noted; one involved an MD-11, although not the occurrence aircraft, and one involved a B-747 IFEN installation.
The incident involving the MD-11 occurred on 30 August 1998. During flight, the F-9 CB for PSU 2 tripped. A reset was performed but the CB tripped again. Following the flight, when maintenance personnel reset the CB, it immediately tripped and a noise was heard from within PSU 2. The defective PSU was replaced, and the aircraft was returned to service. The PSU was subsequently checked, and it was noted that various internal components showed signs of short circuiting. The incident involving the B-747 was also an in-flight failure of a power supply, that cut power to the IFEN. The power supply was changed, and the aircraft was returned to service.
An assessment was completed to determine whether an IFEN PSU could have been the ignition source for the fire in SR 111. The recovered portions of the IFEN PSUs from SR 111 were examined, and no signs of fire damage were noted. In addition, there was no fire damage in the areas surrounding the PSUs. These observations are consistent with the hypothesis that the PSUs were located too far aft in the aircraft to fit the observed fire damage pattern. Overheating or failure of any of the IFEN PSUs was ruled out as a potential ignition source.
22.214.171.124 Post-occurrence IFEN documentation and installation
During the review of the IFEN system installation documentation, various discrepancies were noted in the approved drawings and supporting documentation prepared by HI. Examples of discrepancies include conflicting information between drawings, incorrect wire and pin identification, and incorrect references to other documents.
The information contained in the STC-approved type design data package did not contain sufficient detail to completely define the IFEN system installation configuration. Specifically, there were no installation drawings or supporting documentation that described how the PSU cables and 16 AWG control wire were to be routed through the area from the aft end of the lower avionics CB panel rearward to approximately STA 515. Instead of providing detailed drawings and installation information, in repeated instances, the data package documents referenced AC 43.13-1A, which provides general guidance for "best practices." This approach relies heavily on the training and experience of the individuals completing the installation work to determine wire routing and ensure quality of the installation.
At the time that the IFEN installations were taking place, there appeared to have been a broad range of interpretations as to what constituted an appropriate design package and what documentation was necessary to make acceptable findings of compliance for modifications such as the IFEN system. The FAA requirements stipulated that a drawing package be produced that completely defines the configuration, material, and production processes necessary to produce each part in accordance with the certification basis of the product. The requirements also stipulated that descriptive data packages should completely and accurately describe the fabrication, assembly, and installation of all portions of the modification.Footnote 104 The data package produced by HI was acceptable to the FAA's delegate (the DAS: SBA).
During the year that the occurrence aircraft operated with the IFEN installed, no discrepancies were noted in the aircraft records that could be attributed to the installation of the four PSU cables and 16 AWG control wire into the area from the aft end of the lower avionics CB panel rearward to approximately STA 515. However, an examination of the other MD-11s in the Swissair fleet revealed several discrepancies. Some instances were noted where IFEN wires were not installed in accordance with the installation drawings. Discrepancies included terminal lug connections on the PSU CBs that used attaching hardware that was not in accordance with the drawing information, and wires that were attached to the PSU CBs in a manner that would not be considered best practice. For example, it was noted that the installation drawings and EO did not specify a bonding strap at the lower avionics CB panel, as would be required when the panel is exposed to 115 V AC power; such as, when the IFEN 115 V CBs were added. Some of the discrepancies may reflect the lack of guidance in the data package. Wire routing varied from aircraft to aircraft.
The lack of complete and accurate installation information left decisions such as whether to install anti-chafing materials up to the installer. For instance, during TSB inspections of the installations on the other Swissair MD-11s, the PSU cables were found to be routed such that they came into contact with the edge of the fuel quantity data control unit located directly behind the lower avionics CB panel. This contact left indentations in the cable insulation. On some of the installations, spiral wrap was used to protect the cables as they passed the edge of the fuel quantity data control unit; spiral wrap was not observed in some other installations. As the approved data package did not describe the wiring installation within this area, no document change notices were created to record and account for variations in the wire routing. The IFEN PSU cables were at times routed behind aircraft wire runs prior to entering the conduit. For this reason, there was no way to accurately determine how the four IFEN PSU cables and 16 AWG control wire were routed through this area on the occurrence aircraft.
Following the SR 111 occurrence, the TSB monitored the FAA's full-scale fault insertion testing conducted on the IFEN system using specially designed test equipment. The testing involved introducing faults that would attempt to replicate conditions, such as multiple short-circuits, electrical over-current conditions, and cooling fan failures. In every case, the IFEN components performed as designed and did not produce excessive heat or show signs of wire or component damage. This work was carried out in a systematic way in a laboratory environment.
126.96.36.199 IFEN STC project management
The IFEN STC project involved nine companies and agencies: Swissair, IFT, HI, SBA, the FAA, the FOCA, Recaro, Rumbold, and SR Technics.Footnote 105 For the most part, the management of the project was effective despite numerous errors and omissions in documentation. However, a notable exception where overall project management was less than effective was in accomplishing the proper integration of the IFEN with the aircraft electrical system, specifically as it related to emergency procedures.
Swissair contracted with IFT to provide an IFEN that would be compatible with the MD-11 and would be certified to existing standards. IFT did not have the necessary expertise to integrate and certify the system, which necessitated subcontracting to HI. HI could accomplish the design and integration of the system into the aircraft but was not authorized to provide the required FAA certification; consequently, they subcontracted this task to SBA. While the companies involved were assessed by the FAA as having the proper corporate credentials to accomplish the design, installation, and certification, there was a lack of specific knowledge within these three companies about the MD-11 electrical system and about how it was designed to function during emergency procedures.
Some two-party contracts contained contractual obligations with a direct impact on a third party. In some cases, the third party appeared to be unaware of these obligations. Moreover, assumptions were made by IFT and its subcontractors that type-specific information, both operational and technical, would be provided by Swissair. Likewise, assumptions were made by Swissair that IFT, through its subcontractors HI and SBA, possessed the technical and operational capabilities to provide a fully certified IFEN system.
In addition, there was a lack of clarity regarding which entity had overall project management responsibility. The FAA regarded the applicant, in this case SBA, to be responsible for the overall project management of the certification process. However, it was IFT, through its subcontractors, that was obligated to deliver a certified and integrated IFEN system to Swissair. The certification responsibilities were subcontracted through HI to SBA. As such, SBA was responsible for certifying the IFEN system; however, they had no substantive role in the overall project management.
The IFEN STC was a complex project with an ambitious schedule. It required a clearly identified project management structure designed and executed to track a myriad of details. To be effective, such a structure should have ensured that all the elements were in place to design, install, and certify the system to be compatible with the aircraft's type certificate.
1.18.8 Chronological sequence of events
As part of the investigation, relevant information from the FDR, CVR, ATC tapes, FADEC NVM, recorded radar data, and ACARS was compiled in a timeline. (See Appendix D–Timeline.) Some of the information included in this section is also depicted on a map of the flight path (see Appendix A–Flight Profile: Selected Events.)
188.8.131.52.1 Initial anomalies
Monitoring systems at ARINC and INMARSAT indicate that these two systems were functioning normally during the flight of SR 111. The INMARSAT logs indicate that the satellite telephone service on SR 111 was not used during the flight. The occurrence flight remained within the normal range for VHF coverage. When VHF coverage is available, it is the primary path for data exchange.
Audit logs from the service providers SITA, ARINC, and INMARSAT show that both the ACARS and SATCOM systems of SR 111 initialized and functioned as expected while the aircraft was at the gate at JFK airport in New York. The systems logged onto their networks at 2318:55 and 2330:18 respectively. The SATCOM logged on as a Class 3 mode for voice and data transmission, which indicates that the ACARS management unit (MU) and the satellite data unit were operational at this time.
The ACARS is designed such that if it is not used for 10 minutes, the ACARS MU will send a tracker message to let the service provider know that the aircraft ACARS receiver is still within the coverage area. An ARINC message was sent by SR 111 at 0021:18. Tracker messages would have been expected from the aircraft at about 0031:18 and 0041:18. There is no record that either of these tracker messages were received by a ground station, although the internal ACARS MU system and message counters were updated, as shown by subsequent messages recorded by the service providers. This indicates that messages were logged by the ACARS as being sent during that time frame. It is possible that the system could have logged onto one of two other networks that had some overlap coverage in the area. This can happen if one system becomes saturated. Records for verification of this information were unavailable by the time this aspect of the investigation was conducted and the data were requested by the investigation team.Footnote 106
184.108.40.206.2 Thirteen-minute gap in VHF communications
About 15 minutes after take-off, a 13-minute gap in radio communications occurred between SR 111 and Boston ARTCC. The last communication from SR 111 prior to the gap occurred at 0033:12 when the captain acknowledged a radio frequency assignment change from Boston ARTCC (124.52 MHz to 128.75 MHz). Nine seconds later (0033:21), the FDR recorded a VHF 1 microphone keying event that would be consistent with the pilots attempting to contact Boston ARTCC. No transmission from SR 111 was heard on frequency 128.75 MHz or on any other recorded ATS frequency.
The SR 111 FDR recorded 11 microphone keying events by SR 111 during the 13-minute gap: 9 on VHF 1 and 2 on VHF 2. During this time, Boston ARTCC attempted to contact SR 111 four times on the assigned frequency of 128.75 MHz, three times on the previous frequency of 124.52 MHz, and at least once on the aviation emergency frequency of 121.5 MHz. None of the 11 keying events from the aircraft coincided with the times of the transmissions from Boston ARTCC, indicating that the SR 111 crew was not likely receiving the ATS radio calls.
At 0046:27, SR 111 called Boston ARTCC using VHF 1 on 134.95 MHz, a frequency that had not been assigned to the flight. This transmission was recorded on the ATS tape; however, the Boston ARTCC controller did not comprehend the call that was made on an unassigned frequency and did not immediately respond to this first SR 111 call.
The FDR indicates that at 0047:02, SR 111 attempted another brief call on VHF 1 on an unknown frequency. At 0047:03, INMARSAT logs show a downlink from SR 111 indicating that VHF 3 data communications were lost. This downlink would be consistent with VHF 3 being switched by the pilots from data to voice mode. At 0047:15, SR 111 again called Boston ARTCC using VHF 1 on 134.95 MHz. Communications with SR 111 was restored when Boston ARTCC heard and acknowledged this transmission, and instructed SR 111 to switch to the appropriate frequency for the area control sector they were in (133.45 MHz).
Two-way communications were then restored, and the controller established that the SR 111 crew could hear ATS clearly. There is no record of either the pilots or the controllers at Boston ARTCC making any further comments about the gap in communications. There were no reports of communications difficulties between ATS and any other aircraft in the area. No technical anomalies were recorded on the FDR during the 13-minute gap, and no plausible technical failures were determined during the investigation. It should be noted that FDRs record only a small percentage of the total electrical and systems activity that occurs on an aircraft. Radio communication gaps periodically occur when pilots inadvertently select an incorrect radio frequency when reassigned a new frequency. It is unknown whether this occurred in this instance; however, no other explanation was found.
220.127.116.11.3 Additional ACARS information
About 32 minutes of recorded information was retrieved from the CVR, starting at 0053:17 while SR 111 was cruising at FL330. INMARSAT records indicate that at 0053:51, there was a downlink from SR 111 confirming that VHF 3 communications had been lost for more than seven minutes. The time of this message correlates with the downlink message at 0047:03, indicating the loss of VHF 3 communications, and is consistent with the pilots having switched VHF 3 from data mode to voice mode.
At 0104:14, the ACARS MU sent a downlink message changing coverage from INMARSAT back to ARINC. This would be consistent with the pilots switching VHF 3 from voice mode back to data mode.
After 0104:14, the ACARS functioned as expected. The pilots successfully requested weather information via ACARS at 0113:13 and at 0114:37. The latter request was completed at 0115:18. There was no further crew-initiated communication using ACARS. The last message from ACARS was recorded at 0125:08, when a tracker message for flight following was sent and acknowledged by the system. At 0126:01, the ACARS MU failed as a result of the fire event.
18.104.22.168 Odour detected in the cockpit
The first indication of an abnormal situation was at 0110:38, when the first officer referenced an unusual odour in the cockpit. There were no alerts, warnings, or indications recorded on the FDR to identify any technical problem with the aircraft. No mention was made by the pilots at this time, or during the previous 17 minutes, about any technical problem.
At 0110:57, the captain said "look,"Footnote 107 indicating something was visible in the cockpit; it is probable that it was a small amount of smoke that he observed, based on the comment he made later at 0112:24: "It's definitely smoke which came out."
Having been given permission to stand up at 0111:06, the first officer transferred flying control of the aircraft to the captain at 0111:14, indicating that he was getting up. Fifteen seconds later, at 0111:29, the first officer indicated that there was nothing more "up there." This indicates that the visible smoke ceased within 30 seconds of first being noticed.
At 0112:06, the captain summoned to the cockpit a flight attendant working in the first-class cabin. A few seconds later, she opened the cockpit door and entered the cockpit. In response to a query from the captain, the flight attendant indicated that she could smell the odour in the cockpit, but had not noticed any odour in the cabin where she was working. No references were made to visible smoke at this time.
At 0112:24, based on the comment by the captain, it appears that wherever the smoke may have been originally spotted, the amount was likely small, momentary in nature, and no longer visible. Twice within a period of 18 seconds, the CVR recorded sounds of an electrically driven cockpit seat moving, each time for a period of two seconds. It is unknown whether it was the first officer's or the captain's seat that was moving. The captain commented "Air conditioning, is it?" The first officer answered "Yes." The manner in which the captain framed his inquiry suggests that he was confirming with the first officer the course of action they would undertake, such as selecting the System Display Air Page or the Air Conditioning Smoke Checklist. The first officer's confirmation indicates agreement, suggesting that both pilots agreed that they were dealing with an air conditioning anomaly. The captain indicated that something should be closed; most likely he was requesting that the flight attendant close the cockpit door, as within two seconds, sounds consistent with the cockpit door closing were recorded.
At 0112:52, the FDR recorded that the Air Page was selected on the system display. This selection could have been made anytime within the previous 63 seconds and would not have been immediately recorded by the FDR because of the 64-second sample rate interval for recording this FDR parameter. Selection of the Air Page is an action that the pilots would be expected to take to troubleshoot a suspected air conditioning smoke/fumes anomaly.
At 0112:54, the seat belt lights were activated in reaction to light turbulence being experienced.
At 0113:14, a discernable amount of smoke again became visible to the pilots. They considered potential diversion airports and the need to bring the navigation charts forward from the ship's library. Weather conditions were considered in the assessment of various destinations. The ACARS recorded request was for the following airports: LLSG (Geneva, Switzerland), KJFK (New York, New York), KBOS (Boston, Massachusetts), and CVQM (unknown; it is probable that the pilots meant to input CYQM, which is Moncton, New Brunswick, an airport 90 nm northwest of Halifax).
At 0113:53, the captain commented "That's not doing well at all up there." At 0114:05, the captain attempted to call Moncton ACC, but the radio transmission was blocked by a simultaneous transmission from another aircraft. The frequency had been, and continued to be, busy with calls from other aircraft. These other transmissions would have been heard by the SR 111 pilots.
At 0114:15, the captain radioed Moncton Centre and declared "Pan, Pan, Pan," requesting an immediate return to a convenient place. The captain's tentative airport selection for the diversion was Boston, an airport with which he was familiar. The flight was cleared to proceed to Boston and to maintain FL310. A right turn was initiated toward Boston. At the time of the "Pan Pan Pan" call, the aircraft was at FL330, 66 nm from the threshold of Runway 06 at the Halifax International Airport.
At 0114:48, the captain's oxygen mask was removed from its stowage box, and the sound of oxygen flowing from the mask was evident. The M/C indicated to a flight attendant that he had been advised that there had been some smoke observed in the cockpit, and that the captain did not want the cockpit door to be opened.
22.214.171.124 Diverting to Halifax
At 0115:06, the controller asked the pilots whether they would rather go to Halifax. Having identified Halifax as the closest airport, it was chosen. Halifax was a Swissair-designated intermediate alternate airport, and therefore was approved for MD-11 operations. At 0115:29, the first officer was reassigned the flying duties and instructed to descend immediately. Seven seconds later, the aircraft began descending initially at about 2 000 fpm. The airspeed was at or close to the selected airspeed value of 292 knots, which provided a ground speed of just over 8 nm per minute. The captain continued with radio communication duties. At 0115:36, the captain advised the controller that they would prefer Halifax. At 0115:41, SR 111 was cleared by the controller to proceed directly to Halifax and to descend to FL290. At this time, the aircraft was at FL328, about 56 nm from the threshold of Runway 06.
At 0115:56 and 0116:03, respectively, the captain and first officer donned their oxygen masks. Donning of smoke masks was not included on the Swissair smoke checklists, as it was considered to be a memory item and was a procedure that was practised in the flight simulator by all Swissair flight crews. In their simulator training, flight crews were instructed to don oxygen masks whenever smoke is present. It is not known how much smoke was being seen, if any, but it is likely that at least a smell would have been evident.
Between 0116:08 and 0116:27, the Halifax weather information was passed to SR 111 by the crew of an overflying aircraft. The controller cleared SR 111 to continue descent to 10 000 feet. Moncton ACC was coordinating the arrival of SR 111 with the Halifax tower via a land line. The Moncton controller asked SR 111 for the amount of fuel and the number of passengers on board so that he could pass the information to the Halifax Aircraft Firefighting Services through Halifax tower personnel. SR 111 told the controller to "stand by" for that information.
At 0117:19, the aircraft passed through FL297 and the speed brakes were fully extended. The rate of descent increased to 4 000 fpm, and then reduced to about 3 500 fpm by 0119:28. At 0117:20, the instrument approach plates for the Halifax Airport were not readily available to the pilots to provide information about the runway, minimum safe altitudes, and published approach details. A cabin call chime sounded a few seconds later. The captain then briefed the M/C that there was smoke in the cockpit, that the cabin crew was to prepare for landing in Halifax in about 20 minutes to half an hour, and that he was about to start a checklist. The tone of the captain's voice did not indicate that the situation was sufficiently critical to warrant an emergency; however, he indicated that the passengers were to be briefed that the flight was landing immediately.
With the autopilot engaged, the desired airspeed can be selected by either pilot using a rotary speed-set dial. Based on the FDR sample rate intervals, it is known that the selected airspeed was changed from 292 KIAS to 310 KIAS, during the interval between 0117:16 and 0118:20. Within this time period, at 0117:38, the captain indicated to the first officer that he should not descend too fast, likely referring to the airspeed that was being selectedFootnote 108 rather than the aircraft's rate of descent. It is possible that some higher speed had been momentarily selected and then adjusted to 310 KIAS. At about 0119:24, the selected airspeed was further increased to 320 KIAS. The aircraft's maximum operating airspeed (barber pole speed) was 365 KIAS; the aircraft remained below that airspeed.
At 0118:17, SR 111 was directed to change to Moncton Centre frequency 119.2 MHz. The first officer, who continued as the pilot flying, was also assigned the radio duties. SR 111 was cleared to descend to 3 000 feet, but the first officer advised Moncton Centre of a preference to descend to an intermediate altitude of about 8 000 feet while the cabin was being prepared for landing.
At 0119:12, the controller asked the SR 111 pilots whether they would like radar vectors to Runway 06 at Halifax. The first officer asked for the latest wind information. The controller did not relay the wind information, but repeated that Runway 06 was the active runway and asked whether he should start the radar vectors. SR 111 accepted radar vectors for Runway 06 and the controller instructed SR 111 to turn left to a heading of 030.
The crew bag containing the approach charts for Halifax was stored in the ship's library beneath the right observer's station, an area that is not within reach of the pilots while they are in their seats. The captain had been attempting to contact a flight attendant directly for some time. At 0119:27, a flight attendant entered the cockpit and moved the crew bag containing the approach chart information to within the captain's reach.
At 0119:37, the controller informed SR 111 that the instrument approach to Runway 06 was a back-course approach. He provided the localizer frequency, and advised the pilots that they were 30 miles from the threshold of Runway 06. The aircraft was descending through FL210, and the first officer informed the controller that more than 30 miles would be required. SR 111 was instructed to turn to a heading of 360 degrees, to lose altitude.
At 0120:14, an announcement was made by the M/C to the passengers, informing them that the aircraft would be landing in Halifax in 20 to 25 minutes. The pilots agreed that a quick descent was warranted in case the smoke thickened. The first officer asked the captain whether he agreed with conducting a backbeam approach to Runway 06, indicating that it would be the quickest approach and would result in landing into wind. The first officer also mentioned fuel dumping and asked the captain about his preference for where and when to dump fuel. The captain seemed to concur; however, his verbal response to these inquiries was interrupted by a physical activity involving stretching, consistent with retrieving something that was out of normal reach, perhaps a checklist or an approach chart.
At 0121:20, the controller requested the number of persons and the amount of fuel on board. The first officer responded that there was 230 tonnes of fuel on board; this was actually the current gross weight of the aircraft, not the weight of the fuel alone. He did not relay the number of persons on board. He queried the controller about whether fuel dumping could be done in that area during descent. The controller responded by asking whether SR 111 was able to turn back to the south, or whether they wanted to stay closer to the airport. When conferring about this with the captain, the first officer stated that the controller would prefer that fuel dumping be done to the south, and asked the captain whether they should do that or whether they should go and land. Given their understanding of the current situation, the pilots decided that turning to the south for fuel dumping would be appropriate. The first officer informed the controller that a left or right turn toward the south was acceptable. The controller instructed SR 111 to turn left to a heading of 200 degrees, requested that the pilots indicate when they were ready to dump the fuel, and advised them that it would be about 10 miles before they were off the coast. He advised SR 111 that they were still within about 25 miles from the airport. The first officer informed the controller that they would stay at 10 000 feet, and the controller cleared SR 111 to maintain that altitude. At 0122:21, the speed brakes were retracted as the aircraft descended through 12 550 feet. The rate of descent reduced to 1 000 fpm, then subsequently increased to 2 000 fpm until the aircraft levelled off between 10 150 and 10 300 feet.
At 0122:33, the first officer asked the captain whether he was in the emergency checklist for air conditioning smoke. The captain indicated that he was. At 0122:37, the FDR recorded that the selected indicated airspeed (IAS) had been changed from 320 to 249 KIAS. This is consistent with applicable regulatory requirements, which stipulate that airspeed be reduced to a maximum of 250 KIAS when aircraft are at 10 000 feet or below. At 0122:41, the airspeed began to decrease from 320 KIAS.
At 0122:48, the captain provided some FMS advice as the first officer was "inserting" Halifax airport into the FMS to be able to display airport information, such as runway length and instrument approach information. At 0123:00, as the airspeed was decreasing through 306 KIAS, the first officer asked the captain for his agreement to reduce the speed only slightly. The captain indicated that he was proceeding with the checklist, and that the first officer could fly the aircraft as he thought best.
At 0123:22, the airspeed stabilized at 300 KIAS, never reaching the previously selected 250 knots. (It is likely that the selected IAS was increased to 300 KIAS prior to 0123:22, as the selected airspeed FDR sample at 0123:41 was 300 knots.) At 0123:30, the controller instructed SR 111 to turn to a heading of 180 degrees and advised that they would be off the coast in about 15 miles. The first officer confirmed they were maintaining 10 000 feet. At about 0123:51, possibly in consideration of the information that the coast was still 15 miles ahead, the selected airspeed was further increased to 320 knots. This would be consistent with a desire to start the fuel dumping as soon as possible.
At 0123:45, the captain referred to the CABIN BUS switch and asked for confirmation, which the first officer provided. Selecting this switch to the OFF position is the first item on the Swissair Smoke/Fumes of Unknown Origin Checklist (see Appendix C–Swissair Smoke/Fumes of Unknown Origin Checklist). With the CABIN BUS switch in the OFF position, the recirculation fans are turned off, and the airflow above the forward ceiling area would have changed from a predominant flow aft toward the fans, to a predominant airflow forward toward the cockpit.
At 0123:53, the controller informed SR 111 that the aircraft would remain within 35 to 40 miles of the airport in case they had to land quickly. The first officer indicated that this was fine, and asked the controller to inform them when fuel dumping could start.
Up until this time, there were no failures recorded on the FDR, and there were no indications of any systems anomalies reported by the pilots. As well, no smoke had been reported in the cabin area.
126.96.36.199 Multiple systems failures
Starting at 0124:09, and for the next 92 seconds, the FDR recorded a number of technical failure events that were associated with the failure of aircraft systems, as discussed in the report sections that follow. Both flight recorders and the VHF radios (communications with ATS) stopped functioning at about 0125:41. Near the end of this 92-second period, a reference was made within the cockpit to something burning. It is assessed that the location to which this reference was made was the overhead ceiling area of the cockpit.
188.8.131.52 Autopilot disconnect
At 0124:09, the FDR recorded a disconnect of Autopilot 2. It would be normal for the captain to have his PFD displayed on DU 1, and the first officer to have his PFD set on DU 6. The changes to the PFD displays triggered by the autopilot disconnect would be as follows: the Autopilot 2 status indication text, (displayed as "AP 2 "), which normally appears in a cyan colour, would change to a red flashing "AP OFF," and the lateral and vertical windows would become flashing red boxes. There would also be an aural warning tone; this aural warning tone was heard, beginning at 0124:09 and continuing until the CVR ceased to record.
At 0124:18, the captain noted, and the first officer confirmed, that the autopilot had disconnected. At 0124:25, the first officer informed Moncton ACC that they had to fly manually, and asked for a protected block of altitudes between 11 000 and 9 000 feet. The controller assigned the altitude block between 5 000 and 12 000 feet.
Although the pilots did not verbalize any attempt to cancel the aural tone, this would be an expected reaction in accordance with their training. It is not known whether the pilots attempted to engage Autopilot 1; however, the aural tone did not stop, and Autopilot 1 did not engage. If the crew attempted to engage Autopilot 1 and it was unavailable, the circuit for Autopilot 1, and the circuit required to cancel the aural tone must have already been compromised by the fire. The electrical power circuit for AFS 2 is powered from the 28 V DC Bus 3 through CB E-07 located on the avionics CB panel. One of the wires coming from this CB goes to the control wheel autopilot disconnect switches. The loss of power through this wire (e.g., as a result of being compromised by fire damage) would disconnect the autopilot, and prevent the autopilot aural tone from being reset.
If Autopilot 1 could not be engaged, this indicates that its armed status was inhibited. A failure of Autopilot 1 would, after two minutes, produce annunciator indications that likely would have been noticed by the pilots. The pilots did not mention any annunciator indications associated with Autopilot 1 in that time frame. Therefore, if Autopilot 1 failed it would have done so within the two minutes before Autopilot 2 disconnected and the "AP 2 OFF" alert appeared in the PFD. The electrical power circuit for the AFS 1 is powered from the 28 V DC Bus 1 through CB C-07 located on the avionics CB panel.
184.108.40.206 Altitude alerts
The CVR recorded an altitude alert tone at 0124:38.4 and again at 0124:41.6. The aircraft altitude selector was set to 10 000 feet at this time.
As the aircraft approached 10 000 feet from above, it started to climb again. Information from the FDR indicates that the first officer had changed his altimeter setting to 29.80 in. Hg, whereas the captain had left his altimeter on the standard setting of 29.92 in. Hg, which is the setting required when aircraft are flying above 18 000 feet. The altitude alert system has a 150-foot alert threshold. The two different barometric settings would cause an altitude difference of about 100 feet between the two altimeters. Each FCC would then generate a separate altitude alert tone as their respective thresholds were exceeded, as recorded on the CVR.
220.127.116.11 Declaration of emergency
Starting at 0124:35, and lasting intermittently until 0125:27, a land line conversation took place between Moncton ACC and the Halifax FSS, during which Moncton ACC advised Halifax FSS of the anticipated fuel dumping. The provision of this information, which is in accordance with standard practice, was meant to ensure that other aircraft were informed of the fuel dumping location so that they could stay clear of the area.
At 0124:42, the captain called Moncton ACC and declared an emergency. The first officer, in an overlapping radio transmission, acknowledged that SR 111 was cleared between 12 000 and 5 000 feet, and advised that they were declaring an emergency at time zero-one-two-four (0124). This "emergency" declaration from SR 111 was coincident with the land-line information exchange taking place between the Moncton ACC low-level supervisor and the Halifax FSS.
At 0124:53, the captain called Moncton ACC and indicated that they were starting to dump fuel and had to land immediately. At 0124:57, the controller replied that he would contact them in just a couple of miles, to which the first officer replied "Roger," at 0125:01. At 0125:02, the first officer restated that they were declaring an emergency; the controller acknowledged at 0125:05.
18.104.22.168 Cabin crew use of flashlights
At 0124:46, the cabin crew indicated that they had lost electrical power in the passenger cabin and that they were using flashlights to continue to prepare the cabin for landing. This is consistent with the CABIN BUS switch in the cockpit having been selected to the OFF position using Swissair's procedures, which had been referenced by the pilots at about 0123:45.
22.214.171.124 Loss of lower yaw damper A
At 0124:54, the FDR recorded the failure of lower yaw damper A. The failure was likely the result of a loss of power to the circuit and may not have been obvious to the crew. A message "YAW DMP LWR A OFF" would have been displayed on the EIS status page; however, the information would only be available to the crew if that status page had been selected. It is unknown whether this page was selected.
The lower yaw damper control circuit A is electrically powered from the 28 V DC Bus 1 through CB C-11 located in the avionics CB panel. Lower yaw damper B, which is also powered by the 28 V DC Bus 1 through CB C-12 in the avionics CB panel, did not fail at the same time. This indicates that the 28 V DC Bus 1 was still powered at this time. It is likely that either CB C-11 tripped or that a wire in its circuitry shorted or opened, possibly as a result of heat damage.
126.96.36.199 Loss of flight control computer 1 parameters
At 0124:57, Channel A of FCC-1 lost primary power, and within 15 seconds (at 0125:12), all of the data being reported to the FDR by FCC-1 stopped. The loss of FCC-1 Channel A would drop off some non-flight critical information displayed on the captain's PFD on DU 1, but would not affect the first officer's PFD on DU 6. The first officer was the pilot flying. Under these conditions, the master caution light would illuminate, and faults and various messages would appear on the EAD (typically DU 3), a cue light would illuminate on the SDCP, and warning lights would illuminate on the AFS panel.
The FCC-1 Channel A is electrically powered from the 28 V DC Bus 1 through CB C-17 on the avionics CB panel.
188.8.131.52 Loss of left emergency AC bus
Based on the loss of ADC-1, DEU 1 and the captain's pitot heat, all of which are electrically powered from the left emergency AC bus, it was concluded that this bus was lost at 0125:06. The arced condition of the left emergency AC bus feed wire corroborates this explanation. This arcing event would have tripped the left emergency AC RCCB B1-136 causing the left emergency AC and DC buses to switch to their emergency power source, the battery and static inverter. Subsequently, several system anomalies and failure events occurred, which were recorded on the FDR. A brief explanation of the resulting system losses follows.
184.108.40.206 Loss of altitude, airspeed, and total air temperature
Between 0125:06 and 0125:07, the pressure altitude, computed airspeed, and total air temperature parameters, as recorded in the FDR, became static. After about seven seconds, a no-data-update sequence began, indicating that the data updates to the FDR from ADC-1 were lost.
The aircraft's transponder Mode C, which provides aircraft altitude information to ATC radar, stopped transmitting at 0125:06. This correlates with the loss of functionality of ADC-1. The ATC transponder Mode A (which provides aircraft identification) was still available, indicating that the transponder had not failed.
ADC-1 is electrically powered from the left emergency AC bus through CB F-04 located in the overhead CB panel.
220.127.116.11 Loss of display electronic unit 1
At 0125:06, the data from DEU 1 was lost; a switchover to DEU 3 occurred after 0125:14. Normally, data recorded on the FDR is received through DEU 1. If DEU 1 data is unavailable, the data will freeze for eight seconds, and the source will automatically switch to DEU 3.
Electrical power for DEU 1 is supplied by the left emergency AC bus through CB F-03 on the overhead CB panel. The loss of the left emergency AC bus would result in the captain's DU 1 and DU 3 going blank; the subsequent loss of DEU 1 would cause a red X to appear across DU 2.
18.104.22.168 Change of slat parameter "Retract to transit"
Between 0125:06 and 0125:14, the slats proximity sensor electronic unit B sensors changed from "target near" to "target far." This was a result of electrical power being lost to the B sensors.
The B sensors are powered from the 28 V DC Bus 1 through CB E-09 on the avionics CB panel. The loss of power to this CB would not have any effect on the cockpit displays.
22.214.171.124 Change of TCAS parameter "TR advisory to standby"
Swissair's practice is to use transponder ATC-1 on odd number flights and ATC-2 on even number flights. If ATC-1 loses altitude data from ADC-1, the traffic alert and collision-avoidance system (TCAS) goes into a Standby mode (as was recorded on the FDR) as long as the ATC-2 still has altitude information. The TCAS senses ATC-2 transponder input but does not use that information unless ATC-2 is selected on the ATC control panel. "TCAS STBY" would be displayed on the PFD and NDs, and an "ATC XPDR1 FAIL" message would be displayed on the EAD even though ATC-1 is still transmitting Mode A information. If no air data were available from ATC-2, the TCAS would go into the "OTHER" mode and "TCAS FAIL" would be displayed on the PFD and the NDs. The TCAS "OTHER" mode is a recorded parameter but did not appear on the SR 111 FDR.
This combined information signifies that ADC-2 was still functional at this time.
126.96.36.199 Change of captain's pitot heat "on to off"
Between 0125:06 and 0125:14, the power for the captain's pitot heat was lost. The heater is electrically powered by the left emergency AC bus through CB F-05 located on the overhead CB panel.
The loss of the captain's pitot heat would activate the master caution light, and various cues and alerts would appear on the SDCP, the EAD, and the SD.
188.8.131.52 Loss of VHF-1 reception
At 0125:05.6, an ATC transmission of less than one second was received through VHF 1 and recorded on the CVR. The next ATC transmission, starting at 0125:16, was not recorded by the CVR. The start of the next ATC transmission, starting at about 0125:40, was received and recorded for about 0.2 seconds.
For the CVR to not record an ATC transmission, the VHF signal would have to be lost. The VHF signal can be lost either through a loss of power to the VHF-1 transceiver, or through the transceiver going below a minimum threshold voltage. As the audio signal came back briefly before the end of the recording, it is concluded that the transceiver had gone below the minimum threshold voltage. The cut-out voltage, where the transceiver would stop operating, was found to be about 13 volts.
The VHF-1 transceiver is electrically powered by the left emergency DC bus through CB D-08 on the overhead CB panel.
184.108.40.206 CVR P1 channel intermittent
At 0125:06, the 28 V DC power supply to AMU-1 began to fluctuate around 12 V DC, but did not cut out. This assessment is supported by the fact that starting at this time, there was intermittent, attenuated, and distorted recording by the CVR captain's audio (P1) channel of inputs associated with AMU-1.
220.127.116.11 Loss of Audio Channels on CVR
From 0125:06 to 0125:34, the recording of the P1 channel was intermittent. The first officer's audio channel, the cabin interphone, and the CVR CAM all continued to record normally until 0125:41.4, when the CVR recording stopped.
At 0125:16, Moncton ACC transmitted a clearance to SR 111 to dump fuel on their present track, and to advise when the dump was complete. This transmission was not recorded on the SR 111 CVR. Therefore, it is unlikely that it was heard in the cockpit. A second clearance from Moncton ACC to dump fuel was transmitted at 0125:40. A 0.2 second fragment at the start of this second transmission was recorded 1.4 seconds before the CVR stopped recording.
18.104.22.168 Loss of first officer's display units
At 0125:16, the first officer advised the captain that he was just flying, and not doing anything else. At 0125:20, the captain referred to something that was burning already, and the first officer made a reference to landing. At 0125:33, the first officer indicated that his side was all dark, and also made reference to standby instruments and speed. It is likely that the first officer's three DUs (DU 4, DU 5, and DU 6) had gone blank. For all three displays to go blank, each unit has to lose its own power source. All three units are powered from the right emergency AC bus, which was still powered, through three CBs located on the overhead CB panel at positions F-29, F-30, and F-31. Therefore, either the individual CBs tripped or the integrity of the wiring was compromised.
22.214.171.124 Loss of upper yaw damper A
At 0125:34, the FDR recorded the failure of upper yaw damper A. The failure was likely the result of a loss of electrical power to the circuit. This failure may not be obvious to the crew; however, a message "YAW DMP UPR A OFF" would be displayed on the EIS status page, if that page had been selected. It is unknown whether this page was selected.
The upper yaw damper control circuit A is electrically powered from the 28 V DC Bus 3 through CB E-11 located in the avionics CB panel.
Upper yaw damper control circuit B, which is also powered by the 28 V DC Bus 3 through CB E-12 on the avionics CB panel, did not fail at the same time. This indicates that the 28 V DC Bus 3 was still powered, and that either CB E-11 tripped or a wire in its circuitry experienced an arcing event, possibly as a result of heat damage.
126.96.36.199 Flight data recorder stoppage
Between 0125:39.8 and 0125:40.2, the DFDAU started a warm reboot sequence resulting from a power interruption. The DFDAU re-synchronized and provided additional valid data for 1.3 seconds before the FDR stopped recording.
The DFDAU and the FDR are powered from the 115 V AC Bus 3 through CB D-31 on the avionics CB panel. The warm reboot was the result of either a temporary short or temporary open circuit.
188.8.131.52 Loss of cockpit voice recorder
At 0125:41.4, the CVR stopped recording. This is attributed to a loss of electrical power. The CVR is powered from the right emergency AC bus (phase C) through CB F-20 located on the overhead CB panel.
184.108.40.206 Possible VHF transmission from SR 111
At 0125:46, Moncton ACC recorded an unintelligible fragment of audio that could have been from SR 111.
220.127.116.11 Mode C returned
At 0125:50, transponder Mode C data was regained by ATC until 0126:04.1. Mode C data had been lost with the loss of ADC-1 at 0125:06. If the captain switched to DEU-Auxiliary, DU 2 would be reconfigured to a PFD with the air data parameters showing red Xs. To regain air data, he would have had to switch from ADC-1 to ADC-2. This would have restored air data resulting in ATC regaining Mode C.
18.104.22.168 Loss of transponder
The radar recorded the last transponder Mode A and C returns at 0126:04.1. This failure is attributed to a loss of power to ATC-1 transponder after this time. The ATC-1 transponder is powered from the 115 V AC (phase A) Bus 1 through CB B-21 located on the avionics CB panel.
22.214.171.124 Engine 2 shutdown
Damage to Engine 2 was consistent with an engine that was not producing power at the time of impact. The fault data that was recorded in the NVM of the FADEC indicated that the engine was shut down by use of the FUEL switch at about 1 800 feet;Note de bas de page 109 the airspeed was about 227 knots TAS. In general, during flight operations, the pilots could be expected to shut down an engine if they determined that a malfunction existed that would either cause severe engine damage or collateral aircraft damage, or be a hazard to continued aircraft handling. However, prior to the stoppage of the CVR and the FDR, there was no recorded indication of any mechanical malfunction of the engines, and no indication of any crew intention to shut down Engine 2.
Three FADEC fault entries revealed that Engine 2 had a loss of TRA. Loss of TRA inputs would cause the Engine 2 to revert to a fixed thrust mode and to maintain power at the last validated EPR value (thrust setting); it was determined that this thrust setting was flight idle. Flight crews would not normally be prompted to shut down an operating engine if the only discrepancy was that the thrust setting was fixed at flight idle, unless the planned operation of the aircraft, such as an imminent landing, required such an action.
The power wire for the fire detector loop A for Engine 2 shows clear indication of electrical arcing. This damage to the power wire would cause the loss of power to the fire detector loop A circuit. This would result in the FIRE DET 2 FAULT display, a Level 1 (amber) alert on the EAD, and would not result in a false fire alarm. The wire shorting or opening would not cause any overhead lights to illuminate. The crew never mentioned any alerts being displayed and the arcing event was considered to have occurred later in the sequence after the fire was already established.
If the ground wire for the light circuit to Engine 2 fire handle and fuel condition switch was grounded because of fire damage, then both lights would illuminate. The ground wire for this circuit was routed through an area of known fire damage where arcing events had occurred. This specific wire was not recovered; therefore, its condition could not be confirmed. It is possible that fire damage to this wire triggered illumination of the Engine 2 fire handle lights or FUEL switch light, which could prompt the pilots to shut down Engine 2. The Swissair Engine Fire checklist directs the flight crew to reduce the throttle to idle, then turn off the FUEL switch. This latter switch movement would have registered the faults that were recorded on the FADEC.
This was the last recorded information prior to the time of impact at 0131:18.
1.18.9 Witness information
Immediately after the occurrence, the RCMP Major Crimes Unit (MCU) dispatched four teams of investigators into the area surrounding the occurrence site. TSB investigators worked closely with the RCMP MCU to obtain information from witnesses who heard or saw the aircraft prior to the time of impact.
126.96.36.199 Witness interviewing methodology
TSB and RCMP investigators interviewed more than 200 potential ear and eye witnesses and took 88 separate statements related to the event. TSB investigators reviewed the preliminary statements taken by the RCMP and conducted their own interviews with witnesses who had said that they saw the aircraft during the latter portion of its flight. The majority of the ear and eye witnesses were in the areas of Blandford, East Ironbound Island, Tancook Islands, Indian Harbour, and Peggy's Cove. No witnesses saw the aircraft's impact with the water.
Additional interviews were conducted by law enforcement and safety investigators with personnel, based in New York, whose job functions were related to the security, pre-flight preparation, and dispatch of the occurrence aircraft. TSB and RCMP investigators also interviewed personnel at the involved companies in Zurich.
188.8.131.52 Summary of ear and eye witness information
Investigators collected information from 72 witnesses who said that they saw or heard the occurrence aircraft during the final minutes of its flight. All witnesses indicated that the aircraft was flying at normal flight attitudes, characterized by gentle banked turns and level or shallow pitch attitudes. Numerous witnesses recalled the loud sound of the aircraft engines.
Several witnesses reported seeing white, red, and green lights illuminated on the exterior of the aircraft. The white light was generally reported to be fixed (not flashing) and more brilliant than the coloured lights, which were flashing. One witness reported seeing blue flames on the left side of the aircraft, forward of the left wing.
Four witnesses reported smelling fuel, kerosene, or oil after the aircraft passed overhead. Three additional witnesses reported feeling moisture falling from the sky after the aircraft passed overhead. One witness at St. Margaret's Bay and a second witness at Blandford described a wedge or triangular-shaped haze trailing behind the aircraft. Line-of-sight estimates from eye witnesses suggest that the aircraft passed over the Blandford/Bayswater area at an altitude of between 2 000 and 5 000 feet agl.
There were no witnesses of the final descent of the aircraft into the water, nor were there any reports of a post-crash fire. Several witnesses recalled hearing a final sound that was similar to a clap of thunder. The sound was of short duration and high intensity, and was followed by silence. The time of the final sound was reported to be at approximately 1030 Atlantic daylight time (0130 UTC).
1.18.10 Reporting of cabin anomalies
184.108.40.206 Reports of unusual odours
On the first flight following a scheduled maintenance inspection, approximately three weeks prior to the SR 111 accident, when HB-IWF was operating as SR 178, an unidentified smell was detected within the aircraft cabin in the vicinity of the L1 door. This location is below an area where some of the heat damage was observed on the SR 111 aircraft wreckage. Various descriptions provided by the aircraft crew included smells similar to an over-heated electrical appliance or an unfamiliar type of gas or chemical. The smell incident was verbally reported to a maintenance engineer immediately following the flight; his inspection of the area did not reveal any discrepancy. Subsequent explanations included a possible residue of an insecticide that had been administered during the maintenance inspection prior to flight or fumes from the cargo compartment. The cargo manifest indicates that some solvents were being carried as dangerous goods in the forward cargo hold during that flight, although no cargo spills or loss claims were reported. The source of this smell on SR 178, which occurred 23 days prior to the accident flight, was not identified. There were no further reports of any recurrence of such a smell condition on the 50 subsequent flights of HB-IWF, and there is no reason to link the events of flight SR 178 to the accident flight.
On two separate occasions, a "burnt" or "burning" odour was detected on another Swissair MD-11 aircraft, HB-IWH. On 11 July 1998, a passenger on board HB-IWH operating as SR 111 detected a burnt odour. The smell was detected in flight after the meal service in the area of passenger seat 14H. On 18 August 1998, a passenger on board SR 264, aircraft HB-IWH, detected an unusual smell described as a burnt odour. The smell was detected prior to take-off in the area of seat 18J, mid-cabin. The M/C investigated, but did not smell anything. He reported this to the flight crew.
Because the same aircraft (HB-IWH) was used for both flights and because on each flight, passengers reported a burnt odour within an area spanning four passenger-seat rows (passenger seat 14H and 18J respectively), investigators assessed the possibility of potential links between the July 1998 and the August 1998 flights of HB-IWH. However, because there are no records or other information indicating the source of the burnt odour on the August 1998 flight and because the passenger from the July 1998 flight only reported the burning smell to the TSB several months after the flight, it was not possible to draw any link between the two events.
220.127.116.11 Procedures for reporting and recording abnormal conditions
A search of the Swissair MD-11 Cabin Flight Report database for additional information concerning abnormal smells on board HB-IWF and other MD-11 aircraft since 1997 resulted in only one other report. At the time of the occurrence, the procedures for cabin crew to record abnormal conditions did not clearly state when a written report (Cabin Flight Report) was required. Also, the procedures for flight crew regarding the recording of abnormal conditions reported to them by cabin crew allowed for discretion by the flight crew. Such abnormal conditions would have been recorded, at the captain's discretion, in the aircraft logbook. A logbook entry would have resulted in a subsequent maintenance action. Because no such entry was recorded in the logbook, an opportunity to troubleshoot the source of the unusual odours was lost.
1.19 Useful or effective investigation techniques
This section describes investigation techniques that are specific to the SR 111 occurrence investigation, as well as the features of these techniques and the reasons for their use.
1.19.1 Exhibit tracking process
18.104.22.168 Physical wreckage databases
Aircraft debris was recovered from the crash site and transported to the CF facilities at 12 Wing Shearwater, Nova Scotia. The progress of the recovery effort was monitored by tracking the weight of all recovered items as a percentage of the total structural weight of the aircraft. Recovered items were sorted and classified by their location on the aircraft and by their potential significance to the investigation. Items that were not considered significant were placed together with other similar items corresponding to the location of the item within the aircraft, and were stored in large boxes. Items categorized as significant for priority examination were photographed and assigned a unique exhibit number; a textual summary description was created for each exhibit. This information was entered into an Evidence and Reports III database used by the RCMP for case management; this factual exhibit information was available to the RCMP and the TSB and was ultimately imported into a separate safety investigation database developed by the TSB. Storage boxes containing items that were sorted and categorized as less significant to the investigation were also entered into the database as composite exhibits, to permit tracking and potential future retrieval as required. The exhibit and reporting database allowed investigators to view photographs and exhibit descriptions for each significant individual item, and to generate summary reports based on that exhibit information.
A separate database was established to track exhibit descriptions and information related to aircraft wiring.
22.214.171.124 Document control
Records supporting the investigation were assigned a document control number and registered in an electronic document control log database. A cover page, known as a "header banner," was produced for each document that was to be optically scanned to be converted to an electronic format. The header banner was used to identify the document content, and provides sufficient details to assist in document retrieval.
SUPERText® case management software,Footnote 110 which merges imaging technology, full-text search capability and structured database technology and allows full text query, was used as the document management system. Components of the software were used to scan and process the records using optical character recognition technology, and further organize the records. SUPERText® search utilities allowed users to retrieve documents using a variety of search criteria including keyword searches, and to view or print high-quality images of these documents.
126.96.36.199 Photograph database
A photograph database was developed to archive the large volume of digital and 35 mm images that were taken by RCMP and TSB investigators. The database was indexed to allow flexible searches by exhibit number, subject matter, date, location, and various other parameters.
1.19.2 Data analysis tools
188.8.131.52 Photographic panoramas and object models
Panoramas and object models of various items within the aircraft were created by taking a series of static photographs from various orientations. Object models were created by rotating an object in 10-degree increments in front of a fixed camera. Panoramas were created by fixing the object and rotating the camera. In both cases, "stitching" softwareFootnote 111 was used to combine the multiple individual photographs to create a two-dimensional rendering of the object. Additional software utilities allowed investigators to view these renderings with a standard web browser, to electronically rotate the images on a two-dimensional plane and to navigate between objects.
184.108.40.206 Computer-aided design analysis
Three-dimensional CAD drawings of the aircraft were received from the aircraft manufacturer.
CAD modelsFootnote 112 of the aircraft structure were developed and were cross-referenced to information about recovered components. Internet browser plug-insFootnote 113 provided the capability to view these CAD drawings with a standard web browser. These tools were used to analyze the routing and spatial orientation of various components, to review temperature patterns, to study the airflow within the aircraft, and to develop fire propagation scenarios.
220.127.116.11 Integrated access to electronic data
A PRODOCsFootnote 114 software application was developed by the TSB to provide a single point of access to investigation data from the RCMP's Evidence and Reports III database, the SUPERText® Research database of hard-copy documents, the photograph database, and the wiring database. It also provides links to other related tools, resources, and applications, including the Cabin Safety Research Technical Group accident database, technical notes, photographic panoramas and object models, two-dimensional and three-dimensional CAD diagrams, and video clips of various investigation activities.
1.19.3 Partial qircraft reconstruction
A full-scale metal framework of the front 10 m (33 feet) of the aircraft fuselage was fabricated by the Nova Scotia Department of Transportation and Public Works Mechanical Branch. Identified portions of primary structure, skin panels, and air conditioning ducts were straightened, fracture matched, sewn together with wire, and installed on the reconstruction mock-up. (See Figure 19.) Galleys 1, 2, and 3 were partially reconstructed over separate wire mesh frames and positioned within the reconstructed framework. Pieces of the cockpit seats, cockpit ceiling liner, and CB panels were puzzled together and subsequently fixed into position within the reconstruction mock-up.
Information derived from the physical reconstruction was incorporated into a three-dimensional computer model of the aircraft forward fuselage section. The reconstruction framework and computer model were used to determine the severity and limits of the fire damage, to identify possible fire origin locations, to clarify the spatial relationships between components, and to illustrate how these relationships may have affected the progression of the fire. These tools were also used to help assess the flammability of materials and to identify other safety deficiencies.
18.104.22.168 Tabletop reconstruction of cockpit and forward cabin ceiling areas
The reconstructed air conditioning ducts, electrical wiring, and identified components within the forward cabin and cockpit ceiling areas were assembled into a large tabletop mock-up in an attempt to get a top view of the damage patterns and better understand the relative spatial orientation of the items. (See Figure 27.) A wooden frame and clear plexiglass materials were successfully used to rebuild areas that would otherwise become hidden from view once installed in the main reconstruction mock-up. The tabletop mock-up was used to help assess the heat damage pattern.
22.214.171.124 Air conditioning ducts
All of the recovered air conditioning ducts were severely damaged and deformed. Many of the ducts from the front attic area had been heat-damaged; therefore, it was important to reconstruct them to develop an understanding of where the fire started and how it spread. The hundreds of heat-damaged pieces were straightened, fracture matched and sewn together with wire. As only short segments of duct could be rebuilt, it was necessary to consult aircraft manufacturing drawings and expert technicians from the operator and manufacturer to position the rebuilt sections of ducts into the reconstruction mock-up.
1.19.4 Electrical wire arc sites analysis
Twenty segments of electrical wire from the occurrence aircraft exhibited areas of copper melt consistent with characteristics caused by electrical arcing events. Electrical wire arcing can occur when the insulation protecting a powered wire is damaged, exposing the conductor. The arc event creates sufficiently high temperatures to initiate a fire. Alternatively, a fire-in-progress can burn away the wire insulation, exposing the wire conductor. An arc will occur if the conductor makes contact with a conducting material, such as a metal structure or another exposed conductor of different electrical potential. Attempts were made to determine whether the SR 111 electrical wire arcing events were the result of a pre-existing fire or whether the arcing had provided the energy necessary to ignite nearby flammable material.
126.96.36.199 Auger electron spectroscopy
AES is a scientific technique that was used to attempt to differentiate between electrical wire arcs that could have caused a fire and arcs that resulted from being subjected to a fire-in-progress. The technique is based on the premise that combustion by-products are trapped in molten copper during an arcing event. A scanning Auger multiprobe, capable of high-resolution AES, is used to analyze the surface and near-surface chemistry of the copper arc melt sites and to detect the presence of combustion by-products in the resolidified copper. The absence of combustion by-products in the resolidified copper at an arc melt site is indicative of an arcing event that may have taken place in the absence of fire contaminants in the immediate area of the arc, and could indicate that the arc initiated a fire. This method also allows for a chemical examination of the resolidified copper melt surface without destroying the sample.
188.8.131.52 Focused ion beam and transmission electron microscope analysis
Auger spectra typically provide an indication of the presence and amount of specific elements on the surface of a copper arc melt. Knowledge of the vertical elemental profile, morphology, and porosity of selected arc sites was obtained by combining AES techniques with focused ion beam (FIB) etching and transmission electron microscopy (TEM) examination.
Arc sites of particular interest were identified during the AES surface analysis. Subsequently, thin vertical slices (lift-outs) were removed from these specific sites using a Gallium ion gun. A micro-manipulator was used to transfer the lift-outs from the FIB chamber to the TEM. High-resolution photomicrographs were then collected to determine the vertical homogeneity, porosity, grain size, and layering of each sample. Additional TEM analysis was then carried out to determine the elemental depth profile of selected lift-outs.
184.108.40.206 X-Ray microtomography
X-rays were taken of the recovered wire segments that exhibited copper arc melts characteristic of electrical arcing. A transmission X-ray micro-scanner, equipped with a precision object manipulator, was used to produce two-dimensional X-ray images of the wire's internal micro-structure at various orientations. Tomographical reconstruction software was used to render a three-dimensional image of the wire's internal micro-structure, by combining the successive plane-view X-ray images. The resulting micro-tomographs provided a permanent three-dimensional record of the morphology of the original wire samples. Characteristics, such as porosities, extent of melting and solidification, single or multiple arcing events, and inclusions can be assessed. This information can be used to guide decisions pertaining to more intrusive analysis techniques.
1.19.5 Temperature reference coupons
To permit an evaluation of the temperature reached by the hundreds of heat-damaged aircraft pieces, various heat templates or temperature reference coupons were produced in a controlled laboratory environment. The coupons consisted of representative samples of MD-11 aircraft materials, painted in accordance with the original manufacturer's specifications. Each temperature coupon was heated at a fixed temperature for a specified period of time. Temperature reference coupons were produced at 50°F increments for temperatures ranging from 300°F to 1 100°F (149°C to 593°C), and for exposure times of 10, 20, and 30 minutes. Each coupon was characterized by a discolouration of the painted finish that was indicative of the bake temperature and duration of exposure. The effect of immersion in sea water of the heated samples was also determined; at most temperatures the effect on the discolouration was negligible.
Hundreds of pieces of aircraft structure and air conditioning ducting exhibited indications of heat damage. The recovered pieces were compared to the temperature coupons constructed from identical material to determine the approximate temperature and duration of exposure. This information was used to establish heat pattern and temperature distribution within the fire-damaged attic area of the aircraft.
For comparison purposes, metallurgical analysis of temperature coupons and of the hottest recovered aircraft pieces was performed to more closely assess the temperatures reached based on the effect of the heat on the micro-structure of the various samples.
1.19.6 Speech micro-coding analysis
A strong relationship exists between language use and human performance. An analysis of the verbal communications between the pilots within the cockpit, and between the pilots and ATC was conducted to help assess crew coordination, workload, and problem solving in handling the situation. A speech micro-coding protocol was refined from academic literature and was used to classify verbal communication segments in order to derive and analyze relevant data. Cockpit crew communications were partitioned into verbal thought units (VTU), with each VTU representing a verbal communication dealing with a single thought, intent, or action. Nine speech forms and seven qualitative descriptors were used to classify each VTU, and to evaluate the adequacy and appropriateness of the communication. This coding was further used to analyze how task focus, as measured through verbal communication, was distributed between the two pilots.
1.19.7 Fuel detection by laser environmental airborne fluorosensor
A remote sensing aircraft, operated by the Environmental Technology Centre of Environment Canada, was used to search for aviation fuel that may have been intentionally dumped from the SR 111 aircraft as it manoeuvred for landing at the Halifax airport. The remote sensing aircraft was equipped with a Laser Environmental Airborne Fluorosensor (LEAF) system. This sensor collects fluorescence data from various surfaces in the marine and terrestrial environment by shining a laser onto the surface of the earth. Certain compounds, including polycyclic aromatic hydrocarbons found in petroleum oils, absorb and re-emit the laser energy as bands of fluorescence. Few other compounds in the environment show this tendency. In addition, different classes of oil, fluoresce with different intensities and exhibit different spectral signatures, meaning that each class of petroleum oil can be uniquely identified. This technique was successfully used to locate and identify Jet A fuel, the type of fuel on board the occurrence aircraft, in the vicinity of the SR 111 flight path. Although the fuel spectral signature was compared to a fuel sample taken from the JFK airport fuel tank used to refuel SR 111, the LEAF technique did not establish whether the Jet A fuel detected on the ground came specifically from SR 111.
1.19.8 Aircraft engine analysis
220.127.116.11 Industrial x-Ray for assessing internal component positions
During the investigation of the aircraft engines, the need arose to determine the position of the spool valve within the body of the thrust reverser system hydraulic control unit (HCU). The first option was to disassemble the unit. However, during disassembly there is a possibility of altering the positioning of the spool valve and, in light of the corrosion that had developed from submersion in the sea water, disassembly would not have been easily accomplished. Therefore, the unit was transported to an industrial radiograph (X-ray) facility at Canadian Forces Base Shearwater where it was X-rayed. Analysis of the radiograph film easily identified the control valve position within the HCU body. Where disassembly was required, a radiograph was taken prior to disassembly to document the internal positioning of the components for reference purposes. This technique was also used to view the locking mechanism of the thrust reverser system locking actuators.
18.104.22.168 Thrust Setting Determination from Engine Fuel Metering Units
The external examination of the FMU determined that the resting position of the sector gears differed among the three units, suggesting different fuel flows to each of the three engines at the time of impact. Physical examination of the damage to the engines was also consistent with different power settings. The FMUs were transported to the component manufacturer's facility for disassembly and examination under the control of TSB investigators. The objective was to relate the position of the FMU sector gears to the position of the fuel metering valve and fuel flow. During the examination, the position of the fuel metering valve spool relative to the metering valve sleeve was measured and compared against the manufacturer's drawings, to determine fuel flow from these measurements. This information, along with information gathered from other areas of the engines, was helpful in determining the approximate thrust levels of the engines at the time of impact.
22.214.171.124 Determination of engine thrust level via stator vane actuators
The variable stator vane (VSV) control subsystem provides maximum compressor performance by moving the HPC inlet guide vanes and 5th, 6th, and 7th stage HPC vanes to their programmed positions in response to commands from the FADEC. During an engine start, the VSVs may be in an open position until approximately 15 per cent N2, at which time they would close. At speeds above approximately 40 per cent N2, the VSVs modulate to open with increasing N1 and N2 and are fully open at take-off and climb power. The vanes modulate with N1, N2, and Tt2.
The three VSVs were transported to the manufacturer's facility for disassembly and examination under the control of TSB investigators. Measurements were taken from the centre of the piston face to the actuator aft housing surface. This measurement was used to determine the position of the piston relative to the piston full stroke. The results of this calculation were then interpreted to provide engine thrust level. This information, in concert with other factual information gathered from the FMUs and bleed valves, helped to establish the approximate thrust levels of the SR 111 engines at the time of impact.
126.96.36.199 Determination of engine thrust level via bleed valves
The three 2.5 bleed valves, one from each engine, were disassembled and examined at the manufacturer's facility under the direction of TSB investigators. Measurements were taken from the mounting surface of the housing to the end of the piston to determine the "as-received" position of the piston. This measurement value indicates the position of the piston relative to the fully-extended position, and thus reflects the percentage of its full stroke. This percentage reflects the engine thrust level in engine revolutions per minute at the corrected low pressure rotor speed. These values, used in concert with other factual information, helped to establish the approximate thrust levels at the time of impact.
From visual examination of the six 2.9 bleed valves, the determination was made regarding whether the valves were open, closed, or jammed in a position as a result of impact. This information, in concert with other factual information, helped to establish thrust levels at the time of impact.
188.8.131.52 FADEC fault analysis
The FADEC is a source of stored information that is particularly useful for investigating accidents in which the FDR has stopped prematurely, as it did near the end of the SR 111 flight. The information may be downloaded from the NVM at the FADEC manufacturer's facility. If the time-reference that is captured on the NVM can be accurately related to actual time, then engine faults stored in the NVM can be helpful in determining the engine status during an accident sequence. If the FADEC is powered, and only airframe faults and no engine faults are captured in the NVM, then it can be surmised that there were no deficiencies associated with the engine. Airframe faults, particularly faults related to components that provide input data to the FADEC may help establish the engine mode of control at the time of the occurrence. The stored airframe faults may help to establish the serviceability of the airframe during the accident flight. Analysis of the FADEC stored faults determined the SR 111 mode of control of the engines and also provided some altitude and airspeed reference information during the last minutes of flight.
1.19.9 Restoration and extraction of non-volatile-memory information
Many of the LRUs contained information within their NVM that could have been of use to the investigation, especially since the flight recorders stopped nearly six minutes prior to the time of impact. None of the LRUs of interest (FCCs, ADCs, etc.) were recovered intact. However, hundreds of loose circuit boards were recovered in various states of damage; many of the components were either partially or completely stripped from the circuit boards. Because the memory chips are not given any particular distinctive markings, identifying specific chips on circuit boards was very difficult and at times impossible. Honeywell, the manufacturer of the majority of the avionics used on the MD-11, provided technical assistance in identifying these NVM memory devices. It would aid accident investigations if the manufacturers of NVM devices could make them more distinguishable, either through colour coding or other markings.
Of the hundreds of circuit boards examined, only one FCC board still contained an EEPROM microcircuit. The device was damaged, predominately from corrosion and required highly specialized techniques to reconstruct it, including the FIBs technique previously discussed. Because of one stuck address, the memory was extracted in two phases. The second phase repaired the stuck address and the remaining half of the data was recovered.
The extracted data was passed to Honeywell for validation and interpretation. The data contained an ASCII representation of the contents of the maintenance memory EEPROM contained in the central processing unit 1A processor of one of the two FCCs installed on the aircraft. It is not known in which position the FCC was installed: left versus right or FCC-1 versus FCC-2.
Evaluation of the data showed three faults were logged on SR 111, on 3 September 1998 at 0124 UTC at an altitude of 11 328 feet and an airspeed of 321 knots. These were AOA-B TST (angle of attack-B test), AOA INV (angle of attack invalid) and FLAP POS INV (flap position invalid). All three faults are related to a loss of power; however, as the FCC position could not be determined, the faults cannot be isolated to a specific angle of attack vane or flap synchro.
1.19.10 Use of computer fire modelling
To complete the fire investigation, there was a requirement for a better understanding of the effects, or lack thereof, of numerous variables. The TSB elected to further advance its fire investigation by incorporating the knowledge gained from the fire tests conducted at the Aircraft Fire Safety Section at the FAA's William J. Hughes Technical Center in Atlantic City, New Jersey, into a computer model. Using the computer model, additional work was completed to analyze fire dynamics using fire field modelling techniques.
Field models are based on an approach that divides the region of interest into a large number of small elemental volumes. These volumes are each systematically analyzed in increments to determine the overall effect or effects. The approach is computationally intensive and complex, but provides superior results when compared to other techniques, such as zone models, that take a much more simplistic approach to the number and size of elemental volumes analyzed. In the SR 111 occurrence, factors such as complex airframe and duct system geometries necessitated a fire field analysis approach, as opposed to a zonal approach.
- Date modified: