System evaluation: fire hardening considerations
The Transportation Safety Board of Canada recommends that as a prerequisite to certification, all aircraft systems in the pressurized portion of an aircraft, including their sub-systems, components, and connections, be evaluated to ensure that those systems whose failure could exacerbate a fire in progress are designed to mitigate the risk of fire-induced failures.
Air transportation safety investigation report
|
|
---|---|
Date the recommendation was issued |
|
Date of the latest response |
March 2018
|
Date of the latest assessment |
March 2023
|
Rating of the latest response |
Fully Satisfactory
|
File status |
Closed
|
Summary of the occurrence
On 02 September 1998, Swissair Flight 111, a McDonnell Douglas MD-11 aircraft, departed John F. Kennedy Airport in New York, New York, en route to Geneva, Switzerland. Approximately one hour after take-off, the crew diverted the flight to Halifax, Nova Scotia, because of smoke in the cockpit. While the aircraft was manoeuvring in preparation for landing in Halifax, it struck the water near Peggy’s Cove, Nova Scotia, fatally injuring all 229 occupants on board. The investigation revealed that the flight crew had lost control of the aircraft as a result of a fire in the aircraft’s ceiling area, forward and aft of the cockpit bulkhead.
On 28 August 2001, the Board released interim safety recommendations as part of its investigation (A98H0003) into this occurrence.
Rationale for the recommendation
It is an established aviation industry practice to consider the consequences of a system’s failure during the certification process. Section 25.1309 of the Federal Aviation Regulations (FARs) requires that a system safety analysis be conducted as part of a system’s certification process. The purpose of such an analysis is to confirm that the system has been designed and installed using a fail-safe methodology. This approach ensures that equipment failures will not have any adverse effect on an aircraft’s safe flight and landing. Typically, this analysis does not include an assessment of the consequences of the system’s failure as a result of fire. For example, the certification of oxygen systems whose design includes materials with dissimilar properties, without consideration for how this arrangement would affect the integrity of the system when it is exposed to a fire, may allow a latent failure to persist. Similarly, where an air conditioning duct system is made of dissimilar materials (such as aluminium ducts with elastomeric endcaps), an in-flight fire may cause an elastomeric endcap to fail before the aluminium portion of the same duct system. This failure of the endcap material would introduce forced air into a fire in progress and would have the potential to aggravate the fire. Assessing the impact of a system’s failure when exposed to fire, and designing aircraft systems to delay failures that could seriously aggravate an in-flight fire would provide an additional defence in limiting the size and progress of in-flight fires.
The Board believes that a fire-induced material failure in some aircraft systems has the potential to augment the combustion process and exacerbate the consequences of an in-flight fire. Therefore, the Board recommended that
as a prerequisite to certification, all aircraft systems in the pressurized portion of an aircraft, including their sub-systems, components, and connections, be evaluated to ensure that those systems whose failure could exacerbate a fire in progress are designed to mitigate the risk of fire-induced failures.
TSB Recommendation A01-04
Previous responses and assessments
November 2001: response from Transport Canada
In its response of 08 November 2001, Transport Canada (TC) agrees that any system in the pressurized portion of an aircraft should be evaluated before being certified to ensure that the system cannot contribute to an ongoing in-flight fire. The Canadian Airworthiness Manual 525.869 specifies fire protection requirements for electrical, vacuum and oxygen systems and current certification practice requires evaluation of those systems where specific fire risks are likely to occur.
The United States FAR 25.1309 requires that a system safety analysis be conducted as part of the certification process to ensure that equipment failures will not have any adverse effect on the safety of the aircraft. The FAA has directed the Wire Systems Harmonization Working Group to recommend whether the methods of compliance with FAR 25.1309 should be mandated.
Extensive projects are under way by airworthiness authorities in conjunction with the industry to develop improved flammability standards to minimize the probability of materials propagating fire when subjected to realistic fire threats. The corrective actions being considered by the Federal Aviation Administration (FAA) for improved material standards, redesigned circuit breakers and more comprehensive wiring insulation tests all contribute to the intent of a systematic analysis called for in the recommendation.
TC will continue to cooperate with the FAA to clarify any additional amendments to the present certification standard that will promote a system that has been designed and installed using a fail-safe methodology. TC will review the applicable Canadian Aviation Regulations on system fire protection in conjunction with the results of the ongoing research projects and will harmonize any changes required with the other airworthiness authorities.
March 2002: TSB assessment of the response (Satisfactory Intent)
In its response, TC agrees with the intent of the recommendation. However, TC submits that it already requires that electrical, vacuum and oxygen systems be certified against “specific fire risks.” Not extending these measures would constitute the status quo, which the Board’s recommendation cites as the safety deficiency. TC continues by stating that “the FAA has directed the Wire Systems Harmonization Working Group to recommend whether methods of compliance with FAR 25.1309 should be mandated.” Both of these statements provide little clarity as to whether or not TC has recognized the intent of the recommendation and the underlying unsafe condition, or exactly what action is being taken to address the safety deficiency. The staff contacted TC in an attempt to clarify their position. TC advises that, while there is a firm commitment by them, the FAA, and the European Joint Aviation Authorities (JAA) to cooperate in realizing the objectives of this recommendation, details of the action plan are still evolving. Consequently, staff will monitor the emergence of the action plan as TC works with its regulatory partners to address this safety deficiency. Based on the information provided, this response is considered as Satisfactory Intent.
March 2002: next TSB action
TSB staff will closely monitor the progress of the TC/FAA deliberations to determine if their action plan addresses the identified deficiencies.
December 2005: response from Transport Canada
As stated in the Minister’s reply to the recommendation, TC will continue to be involved in the relevant FAA Aviation Rulemaking Advisory Committee (ARAC) and authority harmonization activities with the intention of revising Canadian requirements to harmonize with the international standards.
July 2006: TSB assessment of the response (Satisfactory in Part)
TC’s activity update of 14 December 2005 provides no further information than what is contained in its original response received 09 November 2001. TC states that it will continue to liaise with the FAA with the intention of harmonizing the Canadian Aviation Regulations with international standards. The planned action or the action taken will reduce but not substantially reduce or eliminate the deficiency.
Therefore, the assessment is Satisfactory-in-Part.
July 2006: next TSB action
February 2007: response from Transport Canada
In its activity update dated 07 February 2007, TC restates that it will continue to be involved in the relevant FAA, Aviation Rulemaking Advisory Committee and authority harmonization activities with the intention of revising Canadian requirements to harmonize with the international standards.
July 2007: TSB assessment of the response (Satisfactory in Part)
TC’s response indicates that its action plan consists of revising Canadian requirements to harmonize with the international standards. As in its previous updates, TC has provided little in the way of clarity as to whether or not these international standards are being amended to mitigate the risks identified in Recommendation A01-04. The planned action or the action taken will reduce but not substantially reduce or eliminate the deficiency.
Therefore, the assessment is Satisfactory-in-Part.
October 2007: next TSB action
TSB staff will follow-up with TC in order to seek details as to how harmonizing Canadian requirements with the international standards will address the deficiency identified in Recommendation A01-04.
March 2008: response from Transport Canada
TC’s response restates its original position, in that the Canadian Airworthiness Manual 525.869 specifies fire protection requirements for electrical, vacuum, and oxygen systems; and, current certification practice requires evaluation of those systems where specific fire risks are likely to occur.
Additionally, TC states that it considers this recommendation closed because:
- There is no safety deficiency in Canada;
- No further action will or needs to take place; and
- Any further changes in this area will take place only as a result of international regulation harmonization.
August 2008: TSB assessment of the response (Unsatisfactory)
August 2008: next TSB action
The TSB Air Branch staff will continue to monitor occurrences reflecting similar type deficiencies, and to communicate concerns to TC regarding the deficiency identified in Recommendation A01-04.
September 2009: TSB review of deficiency file status (rating: Satisfactory in Part; file status: Dormant)
In its latest position statement with respect to the deficiency identified in Recommendation A01-04 TC states that as “existing design standards adequately satisfy safety risks with fire and unsafe temperatures” and “nothing in the design standards was identified as a safety deficiency” it considers this recommendation closed.
Therefore, the assessment remains at Satisfactory-in-Part.
The Board also concludes that, as no further action is planned by TC to address any residual risk, continued reassessment will not likely yield further results.
TSB Air Branch staff will not actively monitor TC’s regulatory activities to ensure that those systems whose failure could exacerbate a fire in progress are designed to mitigate the risk of fire-induced failures.
May 2017: TSB review of deficiency file status (rating; Satisfactory in Part; file status: Active)
The Board requested that A01-04 be reviewed to determine if the Deficiency File Status was appropriate. After an initial evaluation, it was determined that the safety deficiency addressed by Recommendation A01-04 needed to be reassessed.
A request for further information was sent to Transport Canada (TC) and a reassessment will be conducted upon receipt of TC's response.
Therefore, the assessment of the response to Recommendation A01-04 remains Satisfactory In Part.
Consequently, the status of Recommendation A01-04 is changed to Active.
Latest response and assessment
March 2018: response from Transport Canada
TC agrees in principle with the recommendation.Footnote 1
The AWM 525.869 (as amended in May 2009) specifies fire protection requirements for electrical, vacuum, and oxygen systems, and current certification practice requires evaluation of those systems where specific fire risks are likely to occur. Specifically 525.869 states.
525.869 Fire Protection: Systems
(a) Electrical system components:
(1) Components of the electrical system must meet the applicable fire and smoke protection requirements of 525.831(c) and 525.863.
(2) Equipment that is located in designated fire zones and is used during emergency procedures must be at least fire-resistant. (amended 2009/05/11)
(3) EWIS components must meet the requirements of 525.1 713. (amended 2009/05/11)
(b) Each vacuum air system line and fitting on the discharge side of the pump that might contain flammable vapours or fluids must meet the requirements of 525.1183 if the line or fitting is in a designated fire zone. Other vacuum air systems components in designated fire zones must be at least fire resistant.
(c) Oxygen equipment and lines must:
(1) Not be located in any designated fire zone,
(2) Be protected from heat that may be generated in, or escape from, any designated fire zone, and
(3) Be installed so that escaping oxygen cannot cause ignition of grease, fluid, or vapour accumulations that are present in normal operation or as a result of failure of malfunction of any system.
TC considers that the risk underlying this recommendation has been mitigated and no further action is planned. Further changes in this area will take place only in the context of harmonization of international regulation.
March 2023: TSB assessment of the response (Fully Satisfactory)
In its latest response, Transport Canada (TC) indicated that it agrees in principle with the recommendation.
Over the course of the Swissair Flight 111 investigation (A98H0003), the TSB issued several recommendations, some pertaining to aircraft wiring, material, and systems fire resistance and flammability standards. Many regulatory and industry actions have been taken over the years that have addressed the safety deficiencies identified in these recommendations:
- New flammability standards were issued by the United States Federal Aviation Administration (FAA) (Title 14 of the Code of Federal Regulations, Part 25.856) in 2003, by TC (Canadian Aviation Regulation [CARs] Standard 525.856) in 2004, and by the European Union Aviation Safety Agency (EASA) (Certification Specification 25.856) in 2009. These standards require insulation materials to undergo a more stringent flammability test, which includes new flammability requirements that address flame propagation. As a result, aircraft manufactured and/or registered in Canada, the U.S., and Europe are no longer manufactured or repaired with MPET or AN-26 thermal acoustic insulation materials.
- Section 525.1357 of the Canadian Airworthiness Manual (AWM) specifies the protection required against aircraft wiring faults, and paragraph 525.1351(b)(4) requires the electrical system to be tested to ensure that transients due to electrical faults will not create a fire hazard. In 2009, TC amended Part V - Airworthiness Manual Chapter 525 for transport category aeroplanes, establishing a new Sub-chapter H: Electrical Wiring Interconnection Systems (EWIS), which provides comprehensive certification requirements, including the assessment of EWIS failure scenarios and consequential effects to other systems.
- TC participated in the FAA’s Aging Transport Systems Rulemaking Advisory Committee (ATSRAC). This committee was tasked to “propose revisions to the Federal Aviation Regulations and associated guidance material as may be appropriate to ensure that non-structural systems in transport airplanes are designed, maintained, and modified in a manner that ensures their continuing operational safety throughout the service life of the airplanes.”
- TC implemented a significant portion of the ATSRAC recommendations, especially the portions relating to requiring design approval holders of certain transport category airplanes to develop and make available instructions for continued airworthiness for the EWIS using the MSG-3 v2005.1 (or later version) enhanced zonal analysis procedure.
- In its latest response, TC references the amendments that were made to AWM 525.869 in May 2009. These amendments specify fire protection requirements for electrical, vacuum, and oxygen systems, and current certification practice requires evaluation of those systems where specific fire risks are likely to occur.
TC is of the opinion that the current requirements of Section 525.869 of the AWM are sufficient. TC also reiterated that any additional changes regarding fire protection requirements for aircraft systems will be made as a result of international harmonization.
The Board believes that the actions taken by TC and the FAA have effectively addressed the safety deficiency identified in Recommendation A01-04. In addition, the Board acknowledges that similar actions have been adopted by EASA. Of note, EASA issued the following three Easy Access Rules for Acceptable Means of Compliance (AMC) for Airworthiness of Products, Parts and Appliances: AMC 20-21 – Programme to Enhance Aeroplane Electrical Wiring Interconnection System (EWIS) Maintenance, AMC 20-22 – EWIS Training Programme, and AMC 20-23 – Development of Electrical Standard Wiring Practices documentation. These AMCs are based on the recommendations submitted to the FAA by ATSRAC as well as relevant FAA regulations and advisory circulars.
Therefore, the Board considers the response to Recommendation A01-04 to be Fully Satisfactory.
File status
This deficiency file is Closed.