Aircraft Accidents and Lessons Unlearned XXXIII: Swissair Flight 111

On September 2, 1998, fifty-three minutes after departing JFK International Airport for a scheduled flight to Geneva, Switzerland, Swissair flight 111, a McDonnell-Douglas MD-11 aircraft, registration number HB-IWF suffered the first indications of an onboard fire. About twenty minutes later, while executing an emergency landing in Halifax, the airliner crashed into Peggy’s Cove, Nova Scotia, Canada. Approximately seven minutes before impact, both the flight data recorder (FDR) and the cockpit voice recorder (CVR) ceased functioning; all radio communications and secondary radar contact were lost. It would remain unknown what the last minutes in the flight compartment were.

The Transportation Safety Board (TSB) of Canada led the investigation; they followed International Civil Aviation Organization (ICAO) Standards and Practices Annex 13. The accident report, A98H0003, demonstrated a call to a higher quality accident report. It did not conclude on the ambiguous ‘probable cause’ but instead the TSB relied on root causes to dig deeper, to find the cause to the cause; the fundamental lessons to be learned. Although it referred to the need for unnecessary changes and technologies, such as cockpit video cameras and other irrelevant fixes, the report stayed the course and delivered on the root problems that made the industry aware of its technological ignorance and the need to catch up in a fast-paced rush for digital improvements that were leaving engineers behind.

The MD-11 was one of the first airliners to mainly employ digital technology. These ‘fly-by-wire’ systems were/are just that: wires replaced the heavy cable systems for flight controls, shrank the size of actuators, employed lighter composite materials and reduced the gauge (wire diameter) of wires that handled lower current wires than their predecessors. This reduced the airliner’s weight and increased efficiency. However, there are always trade-offs; ‘fly-by-wire’ also established a new learning curve for pilots, mechanics and engineers, a curve that did not follow the rules of earlier ‘analog’ aircraft.

Both the FDR and CVR ceased to function well before the crash occurred; each circuit breaker (CB) was close in proximity to the fire, which was a main contributor. The loss of both recorders presented the TSB with a unique problem: how to determine what the flight crew spoke of in the cockpit and what the various control inputs were during the last minutes of flight. The recorders are considered by all accident investigators to be a most important tool.

However, CVRs can become a crutch; a double-edged sword that works against common sense, as seen in the National Air Cargo 102 accident report, AAR-15/01. The correct analysis of the CVR depends heavily upon those who interpret the recorder. In emergency events, words are garbled, distorted inside the oxygen mask; pilots talk over each other or alarms drown out important conversation. FDR information can also be confused when determining what control inputs were the pilots’ and what was caused by the aircraft’s confused signals. The effectiveness of both recorders is also dependent upon power being supplied, constantly. In Swissair 111, it appeared that both recorders suffered failures due to power cut-outs to the recorders themselves.

A primary cause of the in-flight fire that doomed Swissair 111 was determined to be a recently installed In-Flight Entertainment Network (IFEN) into the cabin electrical bus; the IFEN was added post-manufacturer as part of a supplemental type certificate (STC), an engineering design that allows modifications and improvements to an aircraft. While one of the major contributors was location, the most influential cause was the flight crew’s inability to disable the IFEN system, indeed their being unaware the IFEN was not disabled when they deactivated the cabin electrical bus. All systems are designed, per regulation, to be disabled by the flight crew in flight. The IFEN system defied this design.

A second cause was the use of metallized polyethylene terephthalate (MPET) type-acoustical blankets, used to ‘quiet’ airstream noises. The MPET blanket and other materials behind the CB panels were flammable and in close proximity to the CB wiring. These materials did not meet the fire-preventive requirements for the aircraft and contributed to the fire propagation. The CBs used in the STC installation were not capable of protecting against wire arcing events, which contributed to the start of the fire. These hazards also led to a loss of digital instruments vital to aircraft control.

The IFEN, “design, certification, installation, testing and operation presumed that the ‘non-essential, non-required’ designation [of the STC] confirmed that whether failing or operating normally, the IFEN installation would have no adverse effect on aircraft cockpit operations.” This meant that the STC planned for the IFEN system to not become a hazard to the electrical system. However, the STC did not account for the IFEN remaining powered when selecting the CABIN BUS switch to off [powering OFF the cabin electrical bus]. This was a result of poor engineering; the IFEN system remained powered.

The circuit protection for the IFEN was located in the Upper and Lower Avionics (UAL) CB panel, to the right and aft of the First Officer’s seat. The CBs for many flight control, flight attitude, communications and other critical systems, including the FDR were routed to the UAL panel. In addition, wire bundles coming off the UAL panel and other nearby electrical controls were routed behind or in close proximity to the UAL panel.

Wire bundles are comprised of dozens of angel hair sized insulated wires bound together so as to be routed through the structures behind the panels. Individually or as a group, these wires have a low resistance to the effects of heat, which affect their resistance. Overheated, the wire can allow too much current to the circuit, where the CB breaks the circuit shutting off power to the system it protects. Heat can also damage the integrity of the wire permanently.

The TSB found in their report under 4.3.3.2 Limitations of FAR 25.1353 Electrical Equipment and Installations, that separation of the wire bundles behind the CB panel were, per their analysis, inadequate; heat generated behind the CB panel was not evacuated properly. The Flight Crew Reading (Map) Light also was given considerable attention as during other MD-11 inspections, there were problems discovered with the light and the insulation blanket installed behind. Although this was a good find, the map light did not contribute to the fire. Instead, the attention dedicated to the map light occupied three pages of the report and, with other unassociated topics, acted as a distraction to the report’s findings. It would have been better addressed at the report’s conclusion.

What led to this accident were two simple mistakes. The first was an STC was generated and its contents were used to install an IFEN system in the airliner, in fact several sister ships, that did not deenergize a system when selected OFF. Its root cause was the inexperience of the engineer(s) writing the STC with the peculiarities of digital aircraft as opposed to analog. This problem was not limited to digital technologies introduced with airliners like the MD-11; it was also a major upset with composites, lighter metals and the tasks once handled by the second officer. The learning curve was extensive, not only in Operations and Maintenance learning the new aircraft, but it also took years to get airliners like the MD-11’s reliability to where it should be, what the manufacturer advertised it as.

The second root cause was McDonnell-Douglas’s use of MPET insulation blankets and ventilation of heat behind the CB panels. These errors allowed arcing and prevented heat removal that acted together to create a safety hazard.

While the second root cause was more easily rectified with a change in parts; the first was not. For years design flaws were built into aircraft by airliner manufacturers, e.g. Turkish Airlines 981, and/or the modifications found in STCs and other devices of change, as found in the LAS DC-9 accident in Mitu, Colombia in 2003. These are two examples that, without proper research, led to catastrophic events. It is (and was) the responsibility of the Federal Aviation Administration (FAA) to keep a tight grip on engineering. The Swissair 111 tragedy was due to misses on the FAA’s watch. The misses continue because inadequate attention was given in this and other reports to the research needed in correctly writing STCs. However, the new territory of digital was also found to be entered into too quickly.

Swissair 111’s report, bought at a heavy cost, should have been an example of investigatory superiority. Its attention to detail and search for root cause should have been representative of where accident investigation needed to be.