Swissair Flight 111

Date

3 September 1998

Phase of flight

Descent

Location

Atlantic Ocean, about 5 NM south-west of Peggy's Cove, Nova Scotia, Canada

Aircraft

McDonnell Douglas MD-11

Registration

HB-IWF

Operator

Swissair

Flight

Swissair 111

Occupants

229

Fatalities

229All 215 passengers and 14 crew members (2 pilots and 12 cabin crew)

Investigating body

Transportation Safety Board of Canada

Final report

A98H0003

Report date

27 March 2003

Report title

In-Flight Fire Leading to Collision with Water, Swissair Transport Limited, McDonnell Douglas MD-11 HB-IWF, Peggy's Cove, Nova Scotia 5 nm SW, 2 September 1998

On the evening of 2 September 1998, Swissair flight 111, a McDonnell Douglas MD-11 registered HB-IWF, left John F. Kennedy International Airport, New York, for Geneva with 215 passengers and 14 crew. Cruising at FL330 south-west of Halifax, Nova Scotia, the pilots smelled an unusual odour and saw a little smoke. They diverted towards Halifax. They did not know that a fire was spreading above the ceiling at the rear of the cockpit. Twenty minutes and 40 seconds after the first odour, at 01:31:18 UTC on 3 September, the aircraft struck the sea about 5 NM south-west of Peggy's Cove. There were no survivors.

The Transportation Safety Board of Canada (TSB) recovered wreckage from about 55 m of water in salvage operations lasting some 13 months, and rebuilt the front 10 m of the fuselage on a full-scale frame. It found that the fire most likely began with an electrical arc and was fed by materials that had been approved under the certification tests of the day.

The report matters to every pilot because it challenged a common assumption: that smoke can be reliably classified by sight and smell, and that a checklist will isolate the source before it becomes a fire. For crews, the TSB recommended that industry standards treat odour or smoke of unknown origin as a reason to prepare to land expeditiously.

The flight

HB-IWF was built in 1991 and had flown 36,041 hours. The MD-11 is a three-engine, two-pilot development of the DC-10; this aircraft had Pratt & Whitney PW4462 engines and 241 seats, with an in-flight entertainment network (IFEN) in first and business class that had been installed under a US supplemental type certificate. The takeoff weight was about 241,100 kg.

The captain was also an MD-11 simulator instructor who taught the Smoke/Fumes of Unknown Origin checklist. The first officer was pilot flying. The aircraft departed at 00:18 UTC (20:18 eastern daylight time). All times below are UTC, as in the report.

The accident

At 01:10:38, at FL330, the pilots noticed an abnormal smell. About 20 seconds later they saw a small amount of smoke from behind and above them, which soon disappeared. They concluded the source was the air conditioning. When they confirmed smoke again a little over two minutes later, they decided to divert.

The pilots treated the event as an air conditioning smoke problem that justified a quick diversion but not an emergency descent. They were unfamiliar with Halifax, at first had no approach charts within reach (the charts were in the ship's library at the observer's station), and the back-course approach to runway 06 was not pre-programmed in the flight management system. The meal service was under way. The aircraft weighed about 230 tonnes, above the maximum overweight landing weight of 218,400 kg, so they arranged to dump fuel over the sea.

From 01:24:09, systems failed in rapid succession: autopilot, flight control computer channel, left emergency AC bus, the captain's displays, and at about 01:25:30 all three of the first officer's display units. Smoke, heat and then fire came into the cockpit from overhead. After the recorders stopped, radar showed the aircraft continuing south, away from the airport, and then turning. The crew shut down engine 2 at about 1,800 ft, about a minute before impact; one possible reason was a false fire warning from a fire-damaged wire. The structural damage indicated a nose-down attitude of about 20 degrees and more than 60 degrees of right bank at impact; the aircraft was not in controlled flight.

The investigation

Where and how the fire started

The TSB concluded that the fire most likely started in a small area above the right rear cockpit ceiling, just forward of the cockpit rear wall near manufacturing station (STA) 383. Only there could a fire explain all the evidence: smoke that could enter the cockpit near the right overhead air diffuser, where it could be taken for conditioned air; no smoke in the cabin at first; a fire that spread aft above the forward cabin ceiling and later returned forward with greater intensity; and the timing of the system failures.

In that area the only plausible ignition source was an electrical arc. One arc on an IFEN power supply cable, located just forward of STA 383, could not be explained as fire damage. The TSB found it likely associated with the fire's start but could not determine that it was the lead event; at least one other wire was probably involved.

What fed it

The arc alone would not have endangered the aircraft. The main fuel was the cover film of the thermal acoustic insulation blankets, metallized polyethylene terephthalate (MPET), which the TSB found was most likely the first material to ignite and the largest part of the fire load. Silicone end caps on air conditioning ducts, hook-and-loop fasteners, foams, adhesives and splicing tapes also burned. When the duct end caps failed, they added a continuous supply of conditioned air to the fire.

The MPET-covered blankets had been certified with a vertical Bunsen burner test, in which the film shrank away from the flame without igniting. Yet an arc could ignite it readily. The TSB found the certification standards inadequate because they allowed materials that could be ignited and sustain or spread fire. There were no smoke or fire detectors in the area above the ceiling, and none were required; the crew had no way to know a fire existed except by smell and sight.

Circuit breakers and arcs

The IFEN cables were protected by conventional thermal circuit breakers, as elsewhere in the aircraft. These trip on sustained overcurrent according to a time versus current curve. The arcs on two of the power supply cables did not trip their breakers, most likely because their electrical characteristics fell outside that curve. Conventional breakers protect against hard short circuits but not the full range of arc faults; arc-fault circuit breakers were under development.

The IFEN had also been connected to a bus that the CABIN BUS switch did not de-power, contrary to the MD-11's load-shedding design, a latent unsafe condition. Because the fire was already under way when the switch was used, no link was found between this and the fire.

Could the aircraft have been landed?

The TSB calculated that an ideal emergency descent begun at 01:14:18, about the time of the Pan Pan call, could have landed at Halifax at 01:27 at the earliest, with no technical failures or smoke to hinder the crew. Fire-related failures started at 01:24:09, and by the time the recorders stopped the crew had apparently lost the ability to navigate. At some point in the last five minutes the slats became unserviceable, and the auto ground spoilers, autobrakes and anti-skid may also have been lost before a landing. The TSB concluded that from any point after the first odour, the time needed to land would have exceeded the time available before the fire made a safe landing impossible. It also found that the decision to divert was timely, that the crew's actions were consistent with not knowing there was a fire, and that interactions with ATC did not affect the outcome.

Checklists and training

The MD-11 Smoke/Fumes of Unknown Origin checklist could take 20 to 30 minutes to complete, time in which an overheating component can become an ignition source. Neither the Swissair nor the McDonnell Douglas version called for landing preparations at the start; the reference to landing was the last action item. Swissair's guidance was to land at the nearest emergency airport if smoke of unknown origin was "persistent". Training taught crews to classify smoke and choose between the air conditioning and unknown-origin checklists, and simulator sessions typically ended with the smoke clearing. The TSB called it an invalid assumption that human senses can reliably tell electrical smoke from air conditioning smoke.

Recorders

Both recorders were powered from buses supplied by the same generator and stopped together at 01:25:41, leaving the last 5 minutes 37 seconds unrecorded. The investigators had to rebuild those minutes from radar, engine control memory, witness reports and the wreckage.

Probable cause and contributing factors

The TSB lists findings as to causes and contributing factors rather than a single probable cause. Its first finding reads:

The other causal findings, in summary:

• MPET cover material was most likely the first to ignite and the largest part of the fuel; other cover materials, end caps, fasteners, foams, adhesives and tapes also contributed.
• The circuit breakers could not protect against all types of arcing; the fire most likely started from a wire arcing event, and an arc on an IFEN cable near STA 383 was likely associated with it, though it could not be determined whether that arc was the lead event.
• There was no built-in smoke and fire detection or suppression in the area, nor was any required; this delayed identification of the fire and let it spread unchecked until it became uncontrollable.
• Reliance on sight and smell led to the smoke being misidentified as coming from the air conditioning.
• There was no integrated in-flight firefighting plan, nor was one required, so the crew had no procedures or training directing them to find and eliminate the source aggressively and to expedite preparations for a possible emergency landing.
• Certification did not require fire-induced failures to be considered in system safety analyses; the fire-related failure of the duct end caps added a continuous supply of conditioned air to the fire.
• Loss of the primary flight displays and of outside visual references left the pilots reliant on the standby instruments, whose position and small size would have made them difficult to use in the deteriorating cockpit.

Safety recommendations and what changed

The TSB issued recommendations during the investigation and in the final report. Among them:

• Flight recorders (March 1999): cockpit voice recorders of at least two hours, a 10-minute independent power supply for the CVR and cockpit area microphone, and the two recorders on separate generator buses.
• Insulation (August 1999, March 2003): urgent action on MPET-covered blankets and stricter flammability tests for all insulation materials. In May 2000 the FAA issued airworthiness directives requiring removal of MPET-covered insulation blankets, and it developed a radiant panel test.
• In-flight firefighting (December 2000): review fire zone designations for better detection and suppression; checklists for smoke of unknown origin that can be completed quickly; a standard that when odour or smoke of unknown origin appears, the most appropriate course is to prepare to land expeditiously; and a systems approach to firefighting procedures, training, equipment and access to hidden areas.
• Materials, wiring and systems (2001, 2003): flammability standards based on realistic ignition scenarios, certification tests of how wires fail when they arc, designs that mitigate fire-induced system failures, quantitative analysis of systems added by supplemental type certificate, and regulatory standards for circuit breaker resetting.
• Investigation tools (2003): clearer CVR recordings and cockpit image recording.

Lessons for pilots

Treat smoke of unknown origin as a fire until proven otherwise. The Swissair crew acted quickly by the standards of 1998 and still ran out of time. There is no reliable way to tell from the flight deck whether smoke comes from air conditioning, wiring or burning material, and a hidden fire may already be self-sustaining when the first smell appears. See in-flight fire, smoke and fumes.

Put the landing first. A diversion is a trade between risk in the air and the risks of a rushed arrival: overweight, an unfamiliar airport, an unprepared cabin. With a possible fire, the balance is heavily towards landing. Brief the cabin crew early, get the approach information, and accept an overweight landing if the situation demands it, as the Swissair crew had been trained to do in an emergency. See managing non-normal situations and diversions.

Know what your load-shedding really does. A switch labelled CABIN BUS removed power from the cabin buses but not from equipment wired elsewhere. Pilots cannot audit the aircraft's wiring, but they can understand the logic of electrical isolation on their type and the limits of circuit protection: a breaker that has not tripped does not prove a wire is not arcing, and a tripped breaker should be reset in flight only as the manufacturer's guidance allows.

Prepare for the instruments to fail. In the last minutes the pilots had failing displays, smoke, and no outside references at night. Regular practice in flying on the standby instruments, and use of smoke goggles and oxygen, are the defences.

The recorders serve the next crew. The TSB's recommendations for longer CVRs with independent power came partly from the final minutes of this flight, which went unrecorded. See flight recorders.

Crash Investigations pages summarise official investigation reports for study and exam preparation. The investigating body's report is the authoritative account and prevails wherever it differs from this page. Under ICAO Annex 13, an investigation exists to prevent accidents, not to apportion blame or liability.