Transportation Safety Board of Canada
Press Release
March 9, 1999
TSB # A 04/99
TSB Issues Aviation Safety Recommendations for Flight Recorder Duration and Power Supply
(For release 09 March 1999)
(Hull, Quebec) - As a result of its ongoing investigation into the fatal Swissair 111 accident, the Transportation Safety Board of Canada (TSB) has identified safety deficiencies associated with the recording capacity and power supply of flight recorders and has issued four interim aviation safety recommendations.
On September 2, 1998 a Swissair MD-11 crashed near Peggy's Cove, Nova Scotia fatally injuring all 229 occupants on board. Both the aircraft's Flight Data Recorder (FDR) and Cockpit Voice Recorder (CVR) stopped recording about six minutes before the aircraft's impact with the water.
The Cockpit Voice Recorder on Swissair 111 employed a continuous-loop magnetic tape of 30 minutes duration and the earliest information on the CVR begins about 15 minutes before an unusual smell was noted by the flight crew. The majority of newly manufactured solid-state memory CVRs have a two-hour recording capacity and there is a worldwide industry move towards two-hour CVRs. Many aircraft operators are voluntarily replacing their old technology (tape) data and voice recorders with modern solid-state recorders because of the high costs of maintenance and numerous technical problems associated with maintaining old-technology recorders.
When power to the Swissair 111 flight recorders was interrupted at 10,000 feet, the FDR and CVR stopped recording and the aircraft continued to fly for about six minutes with no information being recorded. Power interruptions have resulted in information not being captured during the last minutes of several other recent aircraft occurrences. The TSB believes the CVR and its cockpit area microphone must continue to be powered for short periods of time regardless of the availability of aircraft electrical power.
In the current configuration of the MD-11 aircraft, both recorders are powered through the same electrical bus. Power to that electrical bus sometimes must be cut off by flight crews turning a single switch when dealing with an emergency, thereby simultaneously disabling the FDR and the CVR, and this poses an unnecessary risk of losing critical recorder information.
The TSB believes that safety action is urgently required on these matters and has made recommendations to address the identified safety deficiencies as follows:
As of 01 January 2003, any CVR installed on an aircraft as a condition of that aircraft receiving an original certificate of airworthiness be required to have a recording capacity of at least two hours. (A99-01)
As of 01 January 2005, all aircraft that require both an FDR and a CVR be required to be fitted with a CVR having a recording capacity of at least two hours. (A99-02)
As of 01 January 2005, for all aircraft equipped with CVRs having a recording capacity of at least two hours, a dedicated independent power supply be required to be installed adjacent or integral to the CVR to power the CVR and the cockpit area microphone for a period of 10 minutes whenever normal aircraft power sources to the CVR are interrupted. (A99-03)
Aircraft required to have two flight recorders be required to have those recorders powered from separate generator buses. (A99-04)
The work of the TSB was coordinated with the National Transportation Safety Board (NTSB) of the United States, which is issuing similar recommendations. The NTSB's recommendations are directed specifically to the United States' Federal Aviation Administration, while the TSB recommendations are directed to aviation regulators in Canada and Europe. Both Boards hope that the recommended actions are adopted by civil aviation regulation authorities wordwide.
The Transportation Safety Board of Canada is an independent agency operating under its own Act of Parliament. Its sole aim is the advancement of transportation safety. It is not the function of the Board to assign fault or determine civil or criminal liability.
Interim Air Safety Recommendations
Date issued: 09 March 1999
Forwarded to: The Honourable David Michael Collenette, P.C., M.P. Minister of Transport
Mr. K. Koplin, Secretary General Joint Aviation Authorities, The Netherlands
Subject: Flight Recorder Duration and Power Supply
Background
On 02 September 1998 at 2118 Atlantic daylight saving time, Swissair Flight 111 (SWR 111), a McDonnell Douglas MD-11 aircraft, HB-IWF, departed John F. Kennedy airport in New York, en route to Geneva, Switzerland. On board were 215 passengers and 14 crew members. Approximately 53 minutes after take-off, as the aircraft was cruising at Flight Level 330, the crew noticed an unusual smell in the cockpit. Within about three and a half minutes the flight crew noted visible smoke and declared the international urgency signal "Pan Pan Pan" to Moncton Area Control Centre, advising the Air Traffic Services (ATS) controller of smoke in the cockpit. SWR 111 was cleared to proceed direct to the Halifax airport from its position 58nautical miles southwest of Halifax, Nova Scotia. While the aircraft was manoeuvring in preparation for landing, the crew advised ATS that they had to land immediately and that they were declaring an emergency. Approximately 20 minutes after the crew first noticed the unusual smell, and about seven minutes after the crew's "emergency" declaration, the aircraft struck the water near Peggy's Cove, Nova Scotia, fatally injuring all 229 occupants on board.
To date, the investigation (A98H0003) has revealed heat damage consistent with a fire in the ceiling area forward and aft of the cockpit bulkhead. Both the Flight Data Recorder (FDR) and the Cockpit Voice Recorder (CVR) stopped recording while the aircraft was at approximately 10 000 feet, about six minutes before impact with the water.
Shortcomings related to the duration of CVR recordings and the supply of electrical power to flight recorders have been identified during this and other recent aircraft accident investigations.
Duration of Cockpit Voice Recorder Information
The CVR installed on SWR 111 employed a continuous-loop magnetic tape of 30 minutes duration. The earliest information on the SWR 111 CVR was recorded approximately 15 minutes before the unusual smell was noted by the crew. Crew conversations and cockpit sounds prior to the beginning of the CVR recording may have provided substantial insight into any initiating or precursor events that led to the accident.
Approximately 38 minutes prior to the unusual smell, Boston Center gave SWR 111 a radio frequency change. During the following 13 minutes Boston Center made repeated attempts to contact SWR 111, without establishing contact. Any cockpit conversations, flight deck noises, or attempted crew transmissions that occurred during this period were subsequently overwritten on the CVR, and therefore could not be assessed.
The 30-minute CVR recording capacity was predicated upon the technology available in the early 1960s; this was the amount of tape that could be crash-protected. The Board is concerned that 30 minutes of recording time is not adequate to capture the initiating events and important background information to many accidents. For example, in accidents involving in-flight fire or progressive structural failure, the initiating events typically develop over a period of time longer than 30 minutes. Longer CVR recording capacity also facilitates the investigation of non-catastrophic occurrences, occurrences in which current 30-minute recordings are often overwritten by the time the aircraft has safely stopped on the ground.
Current technology easily accommodates increased CVR recording capacity. In fact, the majority of newly manufactured solid-state memory CVRs have a two-hour recording capacity, and there is a worldwide industry move towards two-hour CVRs. The European Joint Airworthiness Requirements specify that aircraft first certified after 01 April 1998 be fitted with two-hour CVRs. There is also a proposal to include such a requirement in the Standards and Recommended Practices of the International Civil Aviation Organization (ICAO). The ICAO Flight Recorder Panel, consisting of experts from a number of States, met on 12-20 November 1998, and recommended to ICAO's Air Navigation Commission that aircraft manufactured after 01 January 2003 be fitted with two-hour CVRs.
The TSB is aware that many operators are voluntarily replacing their old technology (tape) data and voice recorders with modern, solid-state recorders. The use of these new recorders not only serves safety but also benefits operators directly, as they avoid the high costs and technical problems associated with maintaining outdated old-technology recorders. Additionally, tape recorders no longer meet the most recent United States Technical Standard Orders (TSO) C123a and TSO C124a crashworthiness standards. This industry trend to solid-state recorders makes it timely to require two-hour CVRs.
A lack of recorded voice and other aural information can inhibit safety investigations and delay or prevent the identification of safety deficiencies. Given the need for longer periods of recorded sound to capture the initiating events of aviation accidents and the availability of two-hour CVRs, the Board believes that such recorders should be mandated by regulatory authorities worldwide. However, it also recognizes that a period of several years may be reasonably required for manufacturers and operators to implement this change. Therefore, for newly manufactured aircraft, the Board recommends that:
As of 01 January 2003, any CVR installed on an aircraft as a condition of that aircraft receiving an original certificate of airworthiness be required to have a recording capacity of at least two hours. (A99-01)
Further, the Board believes that, with appropriate lead time, a retrofit program is warranted for aircraft already in service. Therefore the Board recommends that:
As of 01 January 2005, all aircraft that require both an FDR and a CVR be required to be fitted with a CVR having a recording capacity of at least two hours. (A99-02)
Independent Power Source
When aircraft power to the SWR 111 flight recorders was interrupted at 10 000 feet, the FDR and CVR stopped recording. The aircraft continued to fly for about six minutes with no information being recorded. This lack of recorded information has hampered the accident investigation.
Power interruptions have resulted in flight recorder information not being captured during the last minutes of several other recent aircraft occurrences. These include ValueJet (Miami, Florida; DC-9-32; 11 May 1996), TWA flight 800 (East Moriches, New York; Boeing 747-131; 17 July 1996), SilkAir (Palembang, Indonesia; Boeing 737-300; 19 December 1997), Delta Air Lines (Cork, Ireland; MD-11; 08 October 1998), and Delta Express (Orlando, Florida, Boeing 737-232; 15 December 1998).
In modern aircraft, flight data and other data from multiple sources are used by the aircraft systems and by the flight crew to operate the aircraft. To record the parameters it needs, the FDR simply monitors the data flowing through data buses. If electrical power to a particular sensor or data bus is lost, FDR information pertaining to that sensor or data bus will no longer be available. In the event of a total loss of electrical power, essentially there would be no data to record. There may be merit in independently powering the FDR and its flight data acquisition unit in order to capture whatever data are available during partial electrical failures. However, as a minimum, the TSB believes the CVR and its cockpit area microphone must continue to be powered for short periods regardless of the availability of normal aircraft electrical power. This independent power source would allow the continued recording of the acoustic environment of the flight deck, including cockpit conversations and ambient noises, for a specific period.
With maintenance-free independent power sources, it is now feasible to power new-technology CVRs and the cockpit area microphone independently of normal aircraft power for a specific period of time in the event that aircraft power sources to the CVR are interrupted or lost. Therefore, to enhance the capture of CVR information needed for accident investigation purposes, the Board recommends that:
As of 01 January 2005, for all aircraft equipped with CVRs having a recording capacity of at least two hours, a dedicated independent power supply be required to be installed adjacent or integral to the CVR, to power the CVR and the cockpit area microphone for a period of 10 minutes whenever normal aircraft power sources to the CVR are interrupted. (A99-03)
Separate Electrical Buses
In the current configuration of the MD-11, the FDR and CVR installations are both powered from generator AC Bus No. 3. The MD-11 emergency checklist, dealing with smoke/fumes of unknown origin, requires the use of the SMOKE ELEC/AIR switch. This switch is used to cut power to each of the three electrical buses in turn, in order to isolate the source of the smoke/fumes. The nature of this troubleshooting procedure requires that the switch remain in each position for an indeterminate amount of time, typically at least a few minutes. When the SMOKE ELEC/AIR switch is placed in the first (3/1 OFF) position, generator AC Bus No. 3 and No. 1 air conditioning packs are turned off, thereby simultaneously disabling the FDR and the CVR. Additionally, if the smoke/fumes are cleared in this first position, the SMOKE ELEC/AIR switch is to remain in this position for the duration of the flight, which means that the CVR and FDR both remain inactive while there are data to be recorded. Although it has not been established whether the recorders on SWR 111 stopped as a result of deteriorating electrical systems or the selection of the SMOKE ELEC/AIR switch, the fact that both recorders can be disabled by a single switch selection poses an unnecessary risk of losing critical recorder information.
The Federal Aviation Administration's FAR 25.1457 (CVR) and FAR 25.1459 (FDR), Transport Canada's Canadian Aviation Regulations Standards Part V—Airworthiness Manual, Chapter 551, Articles 551.100 and 551.101, and European Civil Aviation Electronics (Eurocae) specifications require that recorders be installed so that they receive power from the electrical bus that provides the maximum reliability for operation without jeopardizing service to essential or emergency loads. With both the CVR and the FDR on the same generator bus, however, a failure of that bus or the intentional disabling of the bus (as could result from checklist actions in an emergency) result in both recorders losing power simultaneously.
To enhance the capture of information needed for the identification of safety deficiencies, the Board recommends that:
Aircraft required to have two flight recorders be required to have those recorders powered from separate generator buses. (A99-04)