Recommendations

Interim Air Safety Recommendations

Date Issued: 04 December 2000

Forwarded to:

The Honourable David Michael Collenette, P.C., M.P.
Minister of Transport

Frank Hilldrup
Accredited Representative for SR 111 Accident
National Transportation Safety Board
United States

Jean Overney, Chief Inspector
Aircraft Accident Investigation Bureau
Switzerland

Subject: In-flight Firefighting

The Circumstances of the Swissair Flight 111 Accident

On 02 September 1998, Swissair Flight 111 (SR 111), a McDonnell Douglas MD-11 aircraft, was travelling from New York to Geneva with 215 passengers and 14 crew on board. Approximately 53 minutes after take-off, as the aircraft was cruising at flight level 330, the crew noticed an unusual smell in the cockpit. Within about three and a half minutes, the flight crew noted smoke and declared the international urgency signal "Pan Pan Pan" to Moncton Air Traffic Services (ATS). SR 111 was cleared to the Halifax airport from its position 58 nautical miles to the southwest. While manoeuvring in preparation for landing, the crew advised ATS that they had to land immediately and declared an emergency. Approximately 20 minutes after the crew first noticed the unusual smell, and about 7 minutes after the crew's "emergency" declaration, the aircraft struck the water near Peggy's Cove, Nova Scotia, fatally injuring all 229 occupants.

Background

The aircraft crashed into the ocean, and all fire damage occurred in flight. The investigation (A98H0003) has identified extensive fire damage above the ceiling in the forward section of the aircraft extending about 1.5 metres forward and 5 metres aft of the cockpit bulkhead. Although the origin of the fire has not been determined, the investigation has revealed safety deficiencies in design, equipment, and crew training, awareness, and procedures related to in-flight firefighting. The elimination of these safety deficiencies would reduce the loss of life by increasing the probability of the prompt detection and suppression of in-flight fires.

The TSB is concerned with the approach taken by the aviation community in minimizing the risk and in addressing the means that are available for an aircraft crew to consistently detect and suppress fires within the pressurized portion of the aircraft.(1)

When confronted with an in-flight fire, an aircraft crew must be prepared to rely solely on their experience and training, and on the aircraft equipment at hand. Therefore, effective in-flight firefighting measures should allow an aircraft crew to quickly detect, analyse and suppress any in-flight fire.(2) While it is difficult to predict how much time might be required to bring a particular in-flight fire under control, the earlier a fire is detected, the better.

Anecdotal information suggests that odour/fumes/smoke occurrences that do not develop into in-flight fires are not unusual but that, where an in-flight fire does develop, there is very little time available to gain control of the fire. The TSB reviewed a number of databases to validate this information. The review confirmed that there are numerous odour/fumes/smoke occurrences; however, occurrences leading to accidents as a result of uncontrolled fires similar to SR 111 are rare. Details of the TSB review of available data are included in Appendix A. This sample of in-flight fire accidents was compiled based on similarity to SR 111. These data indicate that, in situations where there is an in-flight fire that continues to develop, the time from detection until the aircraft crashed varied from 5 to 35 minutes.

Furthermore, the TSB looked at numerous in-flight fire events that, because of variances with the criteria established for the review, were not included in the validation process. Many of these events resulted in fatalities and each contains examples of where one or more components of the firefighting system failed to provide adequate protection. Appendix B contains a sample of these events.

Safety Deficiencies

The TSB has identified safety deficiencies in several aspects of the current government requirements and industry standards involving in-flight firefighting. These deficiencies increase the time required to assess and gain control of what could be a rapidly deteriorating situation. When viewed together, these deficiencies reflect a weakness in the efforts of governments and industry to recognize the need for dealing with in-flight fire in a systematic and effective way.

The Board's interim air safety recommendations address safety deficiencies in the following areas:

  • The lack of a coordinated and comprehensive approach to in-flight firefighting increases the overall risk.
  • Smoke/fire detection and suppression systems are insufficient.
  • The importance of making prompt preparations for a possible emergency landing is not recognized.
  • The time required to troubleshoot smoke/fire problems is excessive.
  • Access to critical areas within aircraft is inadequate.

Integrated Firefighting Measures

An important aspect of the Board's mandate to advance transportation safety is to look beyond the specific circumstances of any single occurrence and identify systemic safety deficiencies. Over the years, lessons learned from a number of accidents have resulted in modifications to aircraft, systems, and procedures as a direct response to specific failures.(3) However, aircraft and equipment design changes aimed at providing better firefighting measures have sometimes been made in isolation from each other. Although considerable efforts have been made to prepare and equip aircraft crews to handle in-flight fires, these efforts have fallen short of adequately preparing aircraft crews to detect, locate, access, assess, and suppress in-flight fires in a coherent and coordinated manner.

In-flight firefighting "systems" should include all procedures and equipment necessary to prevent, detect, control, and eliminate fires in aircraft. This systems approach would include material flammability standards, accessibility, smoke/fire detection and suppression equipment, emergency procedures and training. All of these components should be examined together and the inter-relationships between individual firefighting measures should be re-assessed with a view to developing improved, comprehensive firefighting measures. The Board believes that the most effective in-flight firefighting capability will exist when the various elements of the firefighting system are integrated and complementary; it therefore recommends:

Appropriate regulatory authorities, in conjunction with the aviation community, review the adequacy of in-flight firefighting as a whole, to ensure that aircraft crews are provided with a system whose elements are complementary and optimized to provide the maximum probability of detecting and suppressing any in-flight fire. A00-16

Assessment/Reassessment Rating: Satisfactory in Part

Smoke/Fire Detection and Suppression

Designated Fire Zones

Presently, the requirements for built-in smoke/fire detection and suppression systems are restricted to those areas that are not readily accessible, and in which a high degree of precaution must be taken.(4) Areas such as these, either inside or outside the pressurized portion of the aircraft, are designated as "fire zones" due to the presence of both ignition sources and flammable materials. Consequently, aircraft manufacturers must provide built-in detection and suppression systems in powerplants (including Auxiliary Power Unit (APU)), lavatories, and cargo and baggage compartments.(5) The built-in suppression features are either automatic, as in lavatories, or controlled from the cockpit, as in powerplants. In each case the extinguishing agent must consist of an amount and nature tailored to the types of fire most likely to occur in the area where the extinguisher is used.(6)

There are no requirements for built-in smoke/fire detection and suppression systems in the remaining areas of the pressurized portion of the aircraft. Detection and suppression in non-designated fire zones, such as the cockpit, cabin, galleys, electrical and electronic equipment (E&E) compartments, and attic spaces are, for the most part, dependant on human intervention.(7)

Non-Designated Fire Zones

Detection of smoke and fire in non-designated fire zones depends on the eyes, ears and noses of the crew and passengers. However, while some areas of an aircraft are almost certain to have a human presence during much of a flight, other areas, such as E&E compartments and attic areas, are more remote. A fire may ignite and propagate in these areas well out of the range of any human detection. The United States National Transportation Safety Board (NTSB) report on an Air Canada DC-9 in-flight fire that occurred near Cincinnati on 02 June 1983 suggests that the crew first detected smoke approximately 11 minutes after the related circuit breakers tripped.(8) Compounding this problem, in most transport category aircraft the occupied areas are isolated from the inaccessible areas by highly efficient aircraft ventilation/filtering systems, which can effectively remove combustion products from small fires. These systems can allow small fires to burn undetected by cabin occupants.(9)

Some areas not designated as fire zones have been treated as "benign", from a fire potential perspective. They have not been assessed by the aviation industry as needing built-in fire detection or suppression equipment. Furthermore, there has not been a recognized need either to train aircraft crews for firefighting in all of the non-designated fire zones, or to design aircraft so as to allow quick and easy access to these areas for firefighting purposes.

Aircraft materials must conform to fire-related standards. These requirements necessitate that materials used in compartment interiors, and in cargo and baggage compartments, meet the applicable test criteria.(10) In interim Air Safety Recommendation A99-08, dated 11 August 1999, the TSB identified limitations in these test criteria which allowed flammable material, used as a covering on thermal-acoustical insulation blankets, to be certified for use in aircraft. The Federal Aviation Administration (FAA) is actively pursuing a replacement program for a specific insulation cover material (metallized Mylar), which it deems to pose the greatest risk. Additionally, a more effective test is in development. The FAA's applicable Notices of Proposed Rulemaking (NPRMs) indicate that there are other insulation blanket cover materials that exhibit flame propagation properties similar to those of metallized Mylar.(11) Therefore, even with the FAA's metallized Mylar replacement initiatives, many inaccessible areas containing combustible materials will remain in aircraft remote from smoke/fire detection systems. Additionally, such materials, located in inaccessible areas, are prone to surface contamination which may provide fuel for flame propagation.

There are many spaces, including some large areas, within transport category aircraft that are seldom inspected and that can become contaminated with dust, debris and metal shavings. Inspections conducted under the auspices of the FAA's Aging Transport Non-Structural Systems Plan identified surface contamination on wiring bundles as a hazard.(12) The SR 111 investigation team has observed, in a variety of aircraft, similar contamination on insulation blanket material and on wire bundles. While the extent of the overall contamination problem has yet to be determined, over time debris such as metal shavings may damage wire insulation, which could lead to short-circuiting and, potentially arcing of wires. Additionally, dust and combustible debris would provide fuel and would contribute to fire propagation. Well-designed and well-executed maintenance programs may limit such contamination, but it is unlikely that contamination can be completely eliminated.

In recent years, there have been changes in requirements regarding detection and suppression in areas not previously designated as fire zones. For instance, the inclusion of lavatories as fire zones was largely a result of the lessons learned from the DC-9 accident near Cincinnati. The SR 111 accident, and other occurrences, clearly demonstrate that early detection and suppression are critical in controlling an in-flight fire. The present situation is inadequate, and more needs to be done to improve detection and suppression capabilities in some of the pressurized areas of aircraft. There are significant areas within the pressurized portion of the aircraft, not now deemed to be fire zones, that are virtually inaccessible and in which ignition sources and combustible materials may both be present.

The Board believes that the risk to the travelling public can be reduced by re-examining fire zone designations in order to determine which additional areas of the aircraft ought to be provided with enhanced smoke/fire detection and suppression systems. Therefore, the Board recommends:

Appropriate regulatory authorities, together with the aviation community, review the methodology for establishing designated fire zones within the pressurized portion of the aircraft, with a view to providing improved detection and suppression capability. A00-17

Assessment/Reassessment Rating: Satisfactory Intent

The Risk of Remaining Airborne—Emergency Landing

Both the TSB review and an FAA study indicate that odour/smoke occurrences rarely develop into uncontrolled in-flight fires.(13) Within the aviation industry, there has been much debate concerning appropriate decision making when flight crews are faced with odour/smoke situations. Within the industry, many believe that one of these situations will likely turn out to be a "non-event". This expectation has led to a diminished concern about "minor" odours. Within the aviation industry, there is an experience-based expectation that the source of such odours will be discovered quickly and that troubleshooting procedures will "fix the problem." The same TSB review shows that in situations where there is an unsuppressed in-flight fire, there is a limited amount of time to get the aircraft safely on the ground. Therefore, in situations where odour/smoke from an unknown source occurs, the decision to initiate a diversion and a potential emergency landing must be made quickly.

There are a number of factors that could distract flight crews from initiating an immediate diversion and potential landing. These include: company culture; commercial considerations; general inconvenience; passenger comfort and safety concerns associated with initiating emergency descents; the complications inherent in a diversion to an unfamiliar airport; and aircraft operating limitations.

The SR 111 accident raised awareness of the consequences of an odour/smoke event, and the rate for flight diversions increased as a result. Typically, this post-accident awareness will subside. Recently, some airlines have modified their checklists and procedures to ensure that flight crews have policies, procedures, and training to divert and land immediately if visible smoke from an unknown source appears and cannot be readily eliminated. Along with other initiatives, Swissair amended their MD-11 checklist for "Smoke/Fumes of Unknown Origin" to indicate "Land at the nearest emergency aerodrome" as the first action item.

The Boeing Company issued a Flight Operations Bulletin (No. MD-11-99-04), which states: "Boeing advises that any time smoke has been detected and the source cannot be POSITIVELY identified and eliminated, the aircraft should be landed as soon as possible."

While such initiatives reduce the risk of an accident, the Board believes that more needs to be done, industry-wide. Along with initiating the other elements of a comprehensive firefighting plan, it is essential that flight crews give attention without delay to preparing the aircraft for a possible landing at the nearest suitable airport. Therefore, the Board recommends:

Appropriate regulatory authorities take action to ensure that industry standards reflect a philosophy that when odour/smoke from an unknown source appears in an aircraft, the most appropriate course of action is to prepare to land the aircraft expeditiously. A00-18

Assessment/Reassessment Rating: Fully Satisfactory

Time Required to Troubleshoot in Odour/Smoke Situations

When the source of odour/smoke is not readily apparent, flight crews are trained to follow troubleshooting procedures, in checklists, to eliminate the origin of the odour/smoke. Some of these procedures involve removing electrical power or isolating an environmental system. A variable amount of time is required to assess the impact of each action. It can take a long time to complete the checklist, including troubleshooting actions. For example, the MD-11 Smoke/Fumes of Unknown Origin Checklist can take up to 30 minutes to complete.(14) There is no regulatory direction or industry standard specifying how much time it should take to complete these checklists. The longer it takes to complete prescribed checklists, the greater the chance that a fire will become uncontrollable.

Troubleshooting procedures are most effective if the actions taken by the flight crew eliminate the source of the odour/smoke before it ignites a fire. These procedures can also eliminate an incipient fire if the crew detects the source early enough. However, once a fire reaches a stage where it is able to propagate without continuous re-ignition from the source, further troubleshooting to eliminate the source will not be sufficient to eliminate the fire. Aircraft accident data indicate that a self-propagating fire can develop in a short period of time. Therefore, odour/smoke checklists must be designed such that the appropriate troubleshooting procedures are completed quickly and effectively. The Board is concerned that this is not the case and recommends:

Appropriate regulatory authorities ensure that emergency checklist procedures for the condition of odour/smoke of unknown origin be designed so as to be completed in a timeframe that will minimize the possibility of an in-flight fire being ignited or sustained. A00-19

Assessment/Reassessment Rating: Satisfactory in Part

Efficiency of Fire Suppression in the Pressurized Portion of the Aircraft

Fire suppression for the pressurized portion of an aircraft is provided by hand-held fire extinguishers. The quantity and location of these fire extinguishers depends on the passenger capacity of the aircraft.(15) Hand-held fire extinguishers are mandatory in such spaces as the cockpit and galleys. The effectiveness of hand-held firefighting equipment depends on the size, type and location of the fire, on how accessible the fire is, and on crew training. By design, hand-held fire extinguishers are most effective against small fires, at limited range (up to three metres). Hand-held fire extinguishers have been used most successfully where the fire was small and accessible. In a large commercial aircraft such as the MD-11, there are areas to which the aircraft crew have only limited access and areas that are inaccessible. For example, it would be difficult for an aircraft crew to suppress some fires, using hand-held fire extinguishers, in the attic areas or E&E compartments of a large commercial aircraft.

Where access is relatively easy, such as exposed galley areas, existing procedures and training using hand-held fire extinguishers have proven to be adequate. However, where the source of the smoke/fire is not obvious, or access to the area is difficult, the situation can become hazardous very quickly. Areas that are not readily accessible have not been considered when planning for in-flight firefighting. Therefore, there has been little or no training provided for aircraft crews on how to access areas behind electrical or other panels, attic areas, or E&E compartments. Typically, present designs do not incorporate quick-access openings or other such means to facilitate access to these areas.

The TSB review of SR 111 and other in-flight fire occurrences has shown that where an in-flight fire continues to develop, there is little time between detection of the fire and the loss of aircraft control. It must be anticipated that aircraft systems will be affected, either as a direct result of the fire, or as a result of emergency procedures such as the de-powering of electrical busses. It is imperative that firefighting procedures be well defined and that aircraft crews be well trained in handling all in-flight fires.

Although aircraft crews are trained to fight in-flight fires, there are no requirements that cabin and flight crews train together, or that they be trained to follow an integrated firefighting plan and checklist procedure.(16) For example, neither flight crews nor cabin crews are trained to fight in-flight fires in the cockpit. Several operators contacted by the TSB indicate that flight crews and cabin crews do not receive training specific to fighting fire in the cockpit. The division of roles and responsibilities between the flight and cabin crews with respect to who will be combatting an in-flight fire in the cockpit is not clearly identified in manuals and company procedures.

An uncontrollable in-flight fire constitutes a serious and complicated emergency. A fire may originate from a variety of sources, and can propagate very rapidly. Time is critical. Aircraft crews must be knowledgeable about the aircraft and its systems, and be trained to combat any fire quickly and effectively in all areas, including those which may not be readily accessible. The Board believes that the lack of comprehensive in-flight firefighting procedures, and coordinated aircraft crew training to use those procedures, constitutes a safety deficiency. Therefore, the Board recommends:

Appropriate regulatory authorities review current in-flight firefighting standards including procedures, training, equipment, and accessibility to spaces such as attic areas to ensure that aircraft crews are prepared to respond immediately, effectively and in a coordinated manner to any in-flight fire. A00-20

Assessment/Reassessment Rating: Satisfactory Intent

As the investigation proceeds, should the Board identify additional safety deficiencies in need of urgent attention, it will make further aviation safety recommendations.

Benoît Bouchard
Chairperson

On behalf of the Board

Appendix A

The TSB reviewed data on in-flight fires that occurred between January 1967 and September 1998 to determine an average time between when an in-flight fire is detected and when the aircraft either ditches, conducts a forced landing, or crashes. To more accurately represent the scenario of Swissair Flight 111, instances where an aircraft landed successfully were not included in the sample. The review was limited to fires in commercial transport aircraft with a maximum take-off weight (MTOW) of more than 50,000 lbs. Included in the review were any fires that took place inside the fuselage (cargo, cabin and/or cockpit), while all engine fires, wheelwell fires and explosions (bombs) were excluded. The data came from: ICAO, NTSB, the Aviation Safety Reporting System, TSB, AirClaims, and the Aviation Safety Network. As one would expect, some occurrences appeared in more than one database. The following 15 occurrences were used to calculate the average of approximately 17 minutes:

Type Date Time from first detection
(in minutes)
AN-12   14 January 1967 <10
BAC-111 23 June 1967 <10
Caravelle 26 July 1969 26
Viscount 06 May 1970 <10
IL-62 14 August 1972 <15
IL-18 31 August 1972 <20
B-707 11 July 1973 ~7
B-707 03 November 1973 35
B-707 26 November 1979 17
B-737 23 September 1983 <20
Tu-134 02 July 1986 <20
B-747 26 November 1987 19
DC-9 11 May 1996 <5
AN-32 07 May 1998 <20
MD-11 02 September 1998 20

The TSB research shows that, for an aircraft with an MTOW greater than 50,000 pounds, a fuselage fire that results in an accident is a rare event. The few relevant examples span some 31 years.

Appendix B

The following synopses represent selected occurrences in which a fire was involved.

  • 11 July 1973: After reporting an in-flight fire, a B707 made a forced landing. The aircraft came to rest on its belly as it continued to burn. The investigation revealed that of the 134 people on board, 123 suffered fatal injuries due to smoke inhalation. The investigative agency's report recommended enhancements to smoke and heat detection throughout the aircraft, including areas behind the false ceiling. The report also called for improvements in crew communications and the operating instructions dealing with fire emergencies to enhance crew response during in-flight fire. (Bureau Enquêtes-Accidents, France)
  • 19 August 1980: Approximately 7 minutes after take-off, the crew of an L-1011 received an aural warning indicating smoke in the aft cargo compartment. When the aircraft landed, some 20 minutes later, the fire had penetrated the cabin. All 301 on board perished in the fire. The investigative agency recommended, in part, the use of fire-blocking materials to control fire propagation, changes to crew emergency training, and a review of the operator's Standard Operating Procedures and emergency checklists. (Accident Investigation Authorities, Saudi Arabia
  • 16 October 1993: Approximately 10 minutes after take-off an MD-81 experienced smoke of increasing intensity in the cockpit overhead panel. The aircraft crew was unable to locate the source of the smoke and requested a return to their departure airport. Investigators discovered a failed emergency power switch which created a smoldering electrical fire. Additionally, it was determined that the emergency checklist procedures failed to eliminate the smoke. (German Federal Bureau of Aircraft Accidents Investigation)
  • 05 September 1996: At FL 330 the flight crew of a McDonnell Douglas DC-10F were alerted to smoke in the cabin cargo compartment when smoke detectors activated. After a successful landing and evacuation the fire continued to burn and eventually destroyed the aircraft. The origin or propagation was never determined. (National Transportation Safety Board, USA)
  • 09 January 1998: While in cruise, a Boeing 767 experienced abnormal warnings on the flight deck instrumentation accompanied by tripping of circuit breakers. The flight was diverted, and although the landing was successful, smoke appeared at the forward end of the passenger cabin. Investigators determined that the circuit breakers tripped as a result of electrical arcing/thermal damage to a wire bundle located in the E&E compartment. The investigation concluded that metal contamination was present on the wire bundle and probably assisted the onset of arcing. (Air Accidents Investigation Branch, United Kingdom)
  • 09 November 1998: The flight engineer of a Lockheed L-1011 observed smoke, sparks and a small flame emanating from an overhead circuit-breaker panel. Although the fire was successfully suppressed, multiple systems failures occurred during the descent. The investigation revealed that a circuit-breaker had popped after arcing to an improperly installed wiring clamp. The arcing ignited dust and combustible debris at the back of the circuit-breaker panel. (National Transportation Safety Board, USA)
  • 28 November 1998: A Boeing 747 returned to its departure airport after an apparent fault associated with an E&E compartment cooling system ground exhaust valve. Investigators discovered several arced wires in a small wire harness associated with the exhaust valve. Insulation blanket cover material had subsequently ignited and was consumed by fire. (Air Accidents Investigation Branch, United Kingdom)

1. For the purposes of this discussion, the pressurized portion of the aircraft, or pressure vessel, includes cockpit, cabin, avionic compartments, cargo compartments, etc.

2. For the purposes of this discussion, the term in-flight firefighting includes all procedures and equipment intended to prevent, detect, control, or eliminate fires in aircraft. These include, but are not limited to material flammability standards, accessibility, smoke/fire detection and suppression equipment, emergency procedures, and training.

3. Specific improvements were made to fire detection and suppression in lavatory and cargo areas following the Air Canada accident near Cincinnati, Ohio, and the ValuJet accident in Florida.

4. Each Civil Aviation Authority establishes its own requirements pertaining to in-flight firefighting. Since the MD-11 was certified in the United States, the Federal Aviation Regulations (FARs) are referenced in this document.

5. See FARs 25.854, 25.855, 25.858, 25.1181, 25.1195, 25.1197, 25.1199, 25.1201, 25.1203, 121.308.

6. See FAR 25.851(a).

7. For the purposes of this discussion, the attic is defined as that area between the crown of the aircraft and the drop-down ceiling.

8. See National Transportation Safety Board report DCA83AA028 concerning the 02 June 1983 accident involving an Air Canada DC-9 near Cincinnati, Ohio.

9. Development and Growth of Inaccessible Aircraft Fires Under Inflight Airflow Conditions (DOT/FAA/CT-91/2, dated February 1991).

10. See FARs 25.853, 25.855, and Part I of Appendix F of Part 25.

11. See NPRMs A99-NM-161-AD and A99-NM-162-AD.

12. FAA Aging Transport Non-Structural Systems Plan, dated July 1998.

13. Smoke in the Cockpit Among Airline Aircraft, FAA Report, 12 October 1998.

14. Boeing Flight Operations Bulletin MD-11-99-04.

15. See FAR 25.851(a).

16. See Canadian Aviation Regulations (CAR) Standards section 725.124; Federal Aviation Regulations section 135.331; Joint Aviation Requirements (JAR) 1.965; and International Civil Aviation Organization (ICAO) Annex No. 6, article 9.3.1.