Air transportation safety recommendation A01-04
Reassessment of the Responses from Transport Canada to Aviation Safety Recommendation A01-04
System Evaluation: Fire Hardening Considerations
Recommendation A01-04 in PDF [116 KB]
On 02 September 1998, Swissair Flight 111, a McDonnell Douglas MD-11 aircraft, departed John F. Kennedy Airport in New York, New York, en route to Geneva, Switzerland. Approximately one hour after take-off, the crew diverted the flight to Halifax, Nova Scotia, because of smoke in the cockpit. While the aircraft was manoeuvring in preparation for landing in Halifax, it struck the water near Peggy's Cove, Nova Scotia, fatally injuring all 229 occupants on board. The investigation revealed that the flight crew had lost control of the aircraft as a result of a fire in the aircraft's ceiling area, forward and aft of the cockpit bulkhead.
On 28 August 2001, the Board released interim safety recommendations as part of its investigation (A98H0003) into this occurrence.
Board Recommendation A01-04 (28 August 2001)
It is an established aviation industry practice to consider the consequences of a system's failure during the certification process. Section 25.1309 of the Federal Aviation Regulations (FARs) requires that a system safety analysis be conducted as part of a system's certification process. The purpose of such an analysis is to confirm that the system has been designed and installed using a fail-safe methodology. This approach ensures that equipment failures will not have any adverse effect on an aircraft's safe flight and landing. Typically, this analysis does not include an assessment of the consequences of the system's failure as a result of fire. For example, the certification of oxygen systems whose design includes materials with dissimilar properties, without consideration for how this arrangement would affect the integrity of the system when it is exposed to a fire, may allow a latent failure to persist. Similarly, where an air conditioning duct system is made of dissimilar materials (such as aluminium ducts with elastomeric endcaps), an in-flight fire may cause an elastomeric endcap to fail before the aluminium portion of the same duct system. This failure of the endcap material would introduce forced air into a fire in progress and would have the potential to aggravate the fire. Assessing the impact of a system's failure when exposed to fire, and designing aircraft systems to delay failures that could seriously aggravate an in-flight fire would provide an additional defence in limiting the size and progress of in-flight fires.
The Board believes that a fire-induced material failure in some aircraft systems has the potential to augment the combustion process and exacerbate the consequences of an in-flight fire. Therefore, the Board recommended that:
As a prerequisite to certification, all aircraft systems in the pressurized portion of an aircraft, including their sub-systems, components, and connections, be evaluated to ensure that those systems whose failure could exacerbate a fire in progress are designed to mitigate the risk of fire-induced failures.
Transportation Safety Recommendation A01-04
Response to A01-04 (08 November 2001)
In its response of 08 November 2001, Transport Canada (TC) agrees that any system in the pressurized portion of an aircraft should be evaluated before being certified to ensure that the system cannot contribute to an ongoing in-flight fire. The Canadian Airworthiness Manual 525.869 specifies fire protection requirements for electrical, vacuum and oxygen systems and current certification practice requires evaluation of those systems where specific fire risks are likely to occur.
The United States FAR 25.1309 requires that a system safety analysis be conducted as part of the certification process to ensure that equipment failures will not have any adverse effect on the safety of the aircraft. The Federal Aviation Administration (FAA) has directed the Wire Systems Harmonization Working Group to recommend whether the methods of compliance with FAR 25.1309 should be mandated.
Extensive projects are under way by airworthiness authorities in conjunction with the industry to develop improved flammability standards to minimize the probability of materials propagating fire when subjected to realistic fire threats. The corrective actions being considered by the FAA for improved material standards, redesigned circuit breakers and more comprehensive wiring insulation tests all contribute to the intent of a systematic analysis called for in the recommendation.
TC will continue to cooperate with the FAA to clarify any additional amendments to the present certification standard that will promote a system that has been designed and installed using a fail-safe methodology. TC will review the applicable Canadian Aviation Regulations on system fire protection in conjunction with the results of the ongoing research projects and will harmonize any changes required with the other airworthiness authorities.
Board Assessment of the Response to A01-04 (20 March 2002)
In its response, TC agrees with the intent of the recommendation. However, TC submits that it already requires that electrical, vacuum and oxygen systems be certified against "specific fire risks." Not extending these measures would constitute the status quo, which the Board's recommendation cites as the safety deficiency. TC continues by stating that "the FAA has directed the Wire Systems Harmonization Working Group to recommend whether methods of compliance with FAR 25.1309 should be mandated." Both of these statements provide little clarity as to whether or not TC has recognized the intent of the recommendation and the underlying unsafe condition, or exactly what action is being taken to address the safety deficiency. The staff contacted TC in an attempt to clarify their position. TC advises that, while there is a firm commitment by them, the FAA, and the European Joint Aviation Authorities (JAA) to cooperate in realizing the objectives of this recommendation, details of the action plan are still evolving. Consequently, staff will monitor the emergence of the action plan as TC works with its regulatory partners to address this safety deficiency. Based on the information provided, this response is considered as Satisfactory Intent.
Response to A01-04 (14 December 2005)
As stated in the Minister's reply to the recommendation, TC will continue to be involved in the relevant FAA Aviation Rulemaking Advisory Committee (ARAC) and authority harmonization activities with the intention of revising Canadian requirements to harmonize with the international standards.
Board Reassessment of the Response to A01-04 (12 July 2006)
TC's activity update of 14 December 2005 provides no further information than what is contained in its original response received 09 November 2001. TC states that it will continue to liaise with the FAA with the intention of harmonizing the Canadian Aviation Regulations with international standards. The planned action or the action taken will reduce but not substantially reduce or eliminate the deficiency.
Therefore, the assessment remains at Satisfactory in Part.
Response to A01-04 (07 February 2007)
In its activity update dated 07 February 2007, TC restates that it will continue to be involved in the relevant FAA Aviation Rulemaking Advisory Committee and authority harmonization activities with the intention of revising Canadian requirements to harmonize with the international standards.
Board Reassessment of the Response to A01-04 (24 July 2007)
TC's response indicates that its action plan consists of revising Canadian requirements to harmonize with the international standards. As in its previous updates, TC has provided little in the way of clarity as to whether or not these international standards are being amended to mitigate the risks identified in Recommendation A01-04. The planned action or the action taken will reduce but not substantially reduce or eliminate the deficiency.
Therefore, the assessment is Satisfactory in Part.
Response to A01-04 (11 March 2008)
TC's response restates its original position, in that the Canadian Airworthiness Manual 525.869 specifies fire protection requirements for electrical, vacuum, and oxygen systems, and current certification practice requires evaluation of those systems where specific fire risks are likely to occur.
Additionally, TC states that it considers this recommendation closed because
- there is no safety deficiency in Canada;
- no further action will or needs to take place; and
- any further changes in this area will take place only as a result of international regulation harmonization.
Board Reassessment of the Response to A01-04 (13 August 2008)
TC's response reiterates that the requirements of its Canadian Airworthiness Manual 525.869 are sufficient and that changes dealing with fire protection requirements for aircraft systems will only happen as a result of international harmonization. There has been no action taken or proposed to address the fact that not all aircraft systems in the pressurized portion of the aircraft are evaluated to ensure that their failure does not exacerbate a fire in progress, as identified in Recommendation A01-04. Consequently, the assessment is changed to Unsatisfactory.
Review of A01-04 Deficiency File Status (23 September 2009)
In its latest position statement with respect to the deficiency identified in Recommendation A01-04, TC states that, as "existing design standards adequately satisfy safety risks with fire and unsafe temperatures" and "nothing in the design standards was identified as a safety deficiency," it considers this recommendation closed.
Therefore, the assessment remains at Satisfactory in Part.
The Board also concludes that, as no further action is planned by TC to address any residual risk, continued reassessment will not likely yield further results.
Next TSB action
TSB staff will not actively monitor TC's regulatory activities to ensure that those systems whose failure could exacerbate a fire in progress are designed to mitigate the risk of fire-induced failures.