SR 111 Investigation Report
1.18.7 In-Flight Entertainment Network
In May 1996, Swissair entered into an agreement with IFT to install a then state-of-the-art IFEN system into 16 MD-11 and 5 B-747 Swissair aircraft. (STI1-112) The installations were to be completed under the authority of Switzerland's FOCA, and in accordance with the FAA STC ST00236LA-D. (STI1-113)
184.108.40.206 IFEN Installation Roles and
In the agreement made with Swissair, IFT was responsible for all aspects of integrating the IFEN system into all Swissair MD-11 and B-747 aircraft, including the system-to-aircraft integration design, system certification, hardware installation, ongoing support, training, and continuing airworthiness.
IFT specialized in the design and manufacture of the IFEN system components. To complete the installation project, IFT required the services of others who had expertise in integrating an IFEN into an aircraft design, certifying the system, and installing the system components into the aircraft.
IFT entered into an agreement with HI to perform the IFEN certification, system-to-aircraft integration engineering, and aircraft installation functions. These subcontracted aspects included the development of all necessary engineering drawings and documents and the manufacturing of wire bundles, equipment racks, and structural supports. Under the contract HI was responsible for the hardware installation of the system into all Swissair MD-11 and B-747 aircraft. The installation work was to be done at SR Technics facilities in Zurich, Switzerland.
HI entered into an agreement with Santa Barbara Aerospace (SBA) to perform the FAA certification services, in its capacity as an FAA-approved Designated Alteration Station (DAS). (STI1-115) By agreement with HI and IFT, SBA became the owner of STC ST00236LA-D and became responsible for complying with all regulatory requirements, including continued airworthiness.
In certifying the STC, SBA had been delegated the authority (by the FAA) to act on behalf of the FAA. FAA procedures required that a DAS submit a Letter of Intent (LOI) for each STC project, describing the project in sufficient detail to allow the FAA to determine what level of FAA involvement and oversight would be appropriate.
The Swiss FOCA accepted that an FAA-approved STC could be used for the project. Its acceptance was based on the installation work being accomplished by HI personnel and performed under the provisions of the European JAR 145approved QA program at SR Technics. In addition, HI was required to submit FAA Form 337 to SR Technics, documenting that the system was installed in accordance with the certification requirements of STC ST00236LA-D, and the FAR, Part 43. The Swiss FOCA did not assume any direct responsibility for authorizing or overseeing the IFEN installation project.
SR Technics' function in the Swissair IFEN project was governed by its contract with Swissair, known as the "September 1996 Offer," and by its responsibilities in accordance with its role as the JAR 145 maintenance provider for Swissair's MD-11 fleet. IFT, through its subcontractor HI, was responsible for the design and installation of Swissair's MD-11 IFEN system. SR Technics was responsible for providing logistical support, technical data, and assistance on an "as requested" basis, and for performing the QA on each of the MD-11 IFEN installations in accordance with its JAR 145 obligations. SR Technics was not responsible for reviewing or approving the design and certification of the IFEN system.
220.127.116.11 SBA's Letter of Intent FAA Review (STI1-116)
The FAA received the LOI for the Swissair project from SBA on 23 August 1996, and in accordance with established procedures, assigned an FAA team to review the LOI to determine the appropriate level of FAA involvement. In addition to certification engineers, the team consisted of personnel from the Manufacturing Inspection District Office and the Aircraft Evaluation Group (AEG). The AEG's responsibilities include determining the operational suitability of newly certified or modified aircraft, and unlike the other FAA certification responsibilities, which are delegated, the AEG's responsibilities are not part of the DAS's delegated authority.
The LOI described the IFEN as a "non-essential, non-required passenger entertainment" system. SBA conducted a qualitative system safety analysis in accordance with FAR 25.1309, which concluded that no single failure or latent multiple failure of the system would affect the ability of the aircraft to continue safe flight and landing, significantly increase flight crew workload, or require unusual strength. The LOI also stated that there would be no changes to the pilot or co-pilot panels.
Following their initial review of the LOI, the FAA contacted SBA to advise them of two additional test requirements necessary to certify the IFEN system. The first test involved assessing the crashworthiness of the associated new seat trays; the second involved assessing the flammability of IFEN-related materials being added within the cabin. On 3 October 1996, SBA submitted an amended LOI to the FAA incorporating the additional test requirements. The initial LOI was stamped "FAA Accepted" on 8 October 1996.
Based on the proposed IFEN system as described in the LOI, the FAA determined that SBA was capable of conducting the STC approval process. The FAA expected that SBA would inform them of any subsequent changes to the scope of the project, and that SBA would request FAA expertise as required. Other than those mentioned above, SBA did not submit any written changes to the LOI as the project evolved.
18.104.22.168 Evolution of the IFEN Project under SBA
In completing its certification responsibilities, SBA was responsible for approving data supplied by HI, and for confirming that all aspects of the IFEN design and installation complied with the regulations. SBA was also responsible for witnessing tests, reviewing drawings, and checking for parts and installation conformity. SBA was not responsible for actual design or installation functions in support of the project. In addition, as a DAS, SBA had no certification responsibilities with respect to determining operational suitability.
The primary documents that were available for review by SBA were the drawings and supporting documentation identified in the master data lists and the ELAs produced by HI.
An earlier version of the ELA produced by HI, dated 18 August 1996, stated that electrical power for the IFEN would be supplied from the AC cabin bus distribution system, which could be manually shed during abnormal operations and automatically shed during emergency operations. There is no indication that SBA had access to the early version. Later versions of the ELA produced by HI indicate the power source, for the first- and business-class passenger sections, to be the 115 V AC Bus 2. The change in power supply followed the discovery by HI, in accordance with their analysis of the Swissair MD-11 electrical loads, that the cabin bus distribution system could not supply adequate electrical power to accommodate the full 257-seat IFEN configuration. The use of the 115 V AC Gen Bus 2 altered the intended function of the CABIN BUS switch, and the IFEN integration design did not identify the operational impact of this change. The change to the different power source was not reflected in the LOI submitted to the FAA, nor was a revised LOI submitted to the FAA.
The drawings used by SBA to approve the STC indicated that IFEN CBs were to be added to the lower avionics CB panel in the cockpit. The addition of the CBs into the cockpit was not reflected in the LOI submitted to the FAA.
The ELA work done at HI was completed by staff who had no experience with MD-11 aircraft. Neither SBA nor HI had staff members familiar with the MD-11 electrical design philosophy, which limited their ability to assess the compatibility of the IFEN integration with existing aircraft systems and with AOM checklist procedures. Wording in commercial contracts associated with the IFEN installation project suggested that other parties, including the operator, would be expected to participate in assessing the compatibility of the system-to-aircraft integration. The final ELA for the IFEN integration contained minor inaccuracies and was not provided to SR Technics until after the SR 111 accident.
22.214.171.124 IFEN Integration Electrical Power Supply
In the configuration that was certified, the IFEN was connected to aircraft power in a way that was incompatible with the MD-11 emergency electrical load-shedding design philosophy and was not compliant with the type certificate of the aircraft. The IFEN was powered from the 115 V AC Bus 2, an electrical bus that is not affected by the selection of the CABIN BUS switch.
The CABIN BUS switch was designed to permit removal of all electrical power from the aircraft cabin services, except for emergency services. The first item in the Swissair Smoke/Fumes of Unknown Origin Checklist is to select the CABIN BUS switch to the OFF position. The design of the IFEN system-to-aircraft power integration constituted a latent unsafe condition. However, as the fire was underway at the time the CABIN BUS switch was used (13 minutes, 7 seconds, after the initial smell was noted), no link was established between this latent unsafe condition and the initiation or propagation of the fire.
126.96.36.199 FAA Oversight (Surveillance) of SBA (STI1-117)
The FAA Los Angeles Aircraft Certification Office (LAACO) was responsible for regulatory oversight of SBA, which it accomplished by monitoring individual SBA DAS projects, and by conducting evaluations.
Although the FAA kept an administrative file on SBA, it was not normal business practice for the LAACO to keep records of their day-to-day contacts with SBA, or of their individual STC project monitoring activities. FAA files contained records of two formal evaluations of SBA, one in March 1996, and another in May 1998. Both of these evaluations contained findings of non-compliance with existing requirements; none of these findings were assessed by the FAA as being a threat to flight safety. The findings were described by the FAA as being "paperwork" related. The FAA was satisfied with the response of SBA to each of the evaluations. SBA was in compliance with all FAA requirements for a DAS at the time of the SR 111 occurrence.
Subsequent to the SR 111 occurrence, the FAA conducted a special certification review (SCR) of STC ST00236LA-D. Findings in the SCR point to shortcomings in both SBA's certification procedures and FAA monitoring of the project. On 30 November 1998, SBA relocated its operations to new facilities; regulations required that, because of the move, they must reapply for authority to continue as a DAS. At that time, SBA voluntarily surrendered its DAS certificate to the FAA. Subsequently, SBA became insolvent.
188.8.131.52 FAA Aircraft Evaluation Group Functions (STI1-118)
Certain STC certification services are reserved for FAA approval and are therefore not delegated to a DAS. Such is the case for those certification services provided by the AEG.
Specifically, FAA Order 8110.4A indicates that the AEG should be involved in STC projects that affect operational suitability and ICA. Examples would include changes in crew requirements, flight instrument displays, and minimum equipment lists.
In the case of STC ST00236LA-D, SBA submitted an LOI that concluded that the IFEN was operationally suitable for use in the MD-11 aircraft. The AEG accepted this determination even though, as a DAS, SBA had not been delegated the authority to make such a determination.
184.108.40.206 Information Provided to Swissair and SR Technics
IFT provided technical training that focused on their approved servicing and maintenance activities to SR Technics maintenance personnel. Informal training was also available to Swissair aircraft crews to familiarize them with the operation of the IFEN system. As a result of frequent software-related problems, flight crews were informed through an AOM bulletin that, if necessary, they could use the 28 V DC IFEN CB on the lower avionics CB panel to shut down or reset the system. In the absence of a system ON/OFF switch, this procedure was meant to provide the flight crews with a means of dealing with routine IFEN anomalies. It is reasonable to expect that Swissair flight crews would have believed that if power needed to be disconnected from cabin services, the IFEN system, along with other cabin services, would be de-powered by turning off the CABIN BUS switch.
220.127.116.11 System Design and Analysis Requirements
Compliance with FAR 25.1309 required that a system safety analysis be conducted on the IFEN system. Such analysis ranges from a qualitative assessment (e.g., a Functional Hazard Assessment), based on experienced engineering judgment, to a complex quantitative assessment (e.g., a Failure Modes Effects Analysis), which includes a numerical probability analysis. The FAA's AC 25.1309-1A introduced in 1988 does not differentiate between an "essential" or "non-essential" system but rather requires that failure analysis be performed on all aircraft systems. The IFEN system's functional criticality, assigned by SBA, was described as "non-essential, non-required."
While the FARs do not use or define the term "non-essential, non-required," it is commonly used in the aviation industry to describe a system whose failure will not affect the safe flight and landing of an aircraft. Entertainment systems are typically described as "non-essential, non-required," with assumptions made that any failures would have only a "minor" effect on aircraft operation. This categorization allows the system safety analysis to be accomplished by a qualitative assessment based on prior engineering judgment of similar systems, and on a history of satisfactory in-service experience.
18.104.22.168 Operating Anomalies
In the two Swissair MD-11 aircraft that initially had the IFEN installed in all 257 seats, in warm atmospheric conditions, the operation of the IFEN system added sufficient heat to the cabin that it became difficult to keep the cabin cool. Flight crews were informed that if the cabin became too warm, they were to select the ECON switch to the OFF position; this action would provide colder air in the cabin. Then, if the cabin did not cool sufficiently after four hours of flight, the remedy was to shut down the IFEN by pulling the 28 V DC IFEN CB on the lower avionics CB panel. The occurrence aircraft logbook had no record of any cabin temperature issues related to the IFEN installation. This temperature control problem was resolved when the IFEN was reduced to the 61-seat configuration and was not relevant to the occurrence aircraft.
22.214.171.124 IFEN Maintenance History
IFEN maintenance records for the Swissair fleet were reviewed to find possible failures in wires or electrical components. Two instances of PSU failures were noted; one involved an MD-11, although not the occurrence aircraft, and one involved a B-747 IFEN installation.
The incident involving the MD-11 occurred on 30 August 1998. During flight, the F-9 CB for PSU 2 tripped. A reset was performed but the CB tripped again. Following the flight, when maintenance personnel reset the CB, it immediately tripped and a noise was heard from within PSU 2. The defective PSU was replaced, and the aircraft was returned to service. The PSU was subsequently checked, and it was noted that various internal components showed signs of short circuiting. The incident involving the B-747 was also an in-flight failure of a power supply, that cut power to the IFEN. The power supply was changed, and the aircraft was returned to service.
An assessment was completed to determine whether an IFEN PSU could have been the ignition source for the fire in SR 111. The recovered portions of the IFEN PSUs from SR 111 were examined, and no signs of fire damage were noted. In addition, there was no fire damage in the areas surrounding the PSUs. These observations are consistent with the hypothesis that the PSUs were located too far aft in the aircraft to fit the observed fire damage pattern. Overheating or failure of any of the IFEN PSUs was ruled out as a potential ignition source.
126.96.36.199 Post-occurrence IFEN Documentation and Installation
During the review of the IFEN system installation documentation, various discrepancies were noted in the approved drawings and supporting documentation prepared by HI. Examples of discrepancies include conflicting information between drawings, incorrect wire and pin identification, and incorrect references to other documents.
The information contained in the STC-approved type design data package did not contain sufficient detail to completely define the IFEN system installation configuration. Specifically, there were no installation drawings or supporting documentation that described how the PSU cables and 16 AWG control wire were to be routed through the area from the aft end of the lower avionics CB panel rearward to approximately STA 515. Instead of providing detailed drawings and installation information, in repeated instances, the data package documents referenced AC 43.13-1A, which provides general guidance for "best practices." This approach relies heavily on the training and experience of the individuals completing the installation work to determine wire routing and ensure quality of the installation.
At the time that the IFEN installations were taking place, there appeared to have been a broad range of interpretations as to what constituted an appropriate design package and what documentation was necessary to make acceptable findings of compliance for modifications such as the IFEN system. The FAA requirements stipulated that a drawing package be produced that completely defines the configuration, material, and production processes necessary to produce each part in accordance with the certification basis of the product. The requirements also stipulated that descriptive data packages should completely and accurately describe the fabrication, assembly, and installation of all portions of the modification. The data package produced by HI was acceptable to the FAA's delegate (the DAS: SBA).
During the year that the occurrence aircraft operated with the IFEN installed, no discrepancies were noted in the aircraft records that could be attributed to the installation of the four PSU cables and 16 AWG control wire into the area from the aft end of the lower avionics CB panel rearward to approximately STA 515. However, an examination of the other MD-11s in the Swissair fleet revealed several discrepancies. Some instances were noted where IFEN wires were not installed in accordance with the installation drawings. Discrepancies included terminal lug connections on the PSU CBs that used attaching hardware that was not in accordance with the drawing information, and wires that were attached to the PSU CBs in a manner that would not be considered best practice. For example, it was noted that the installation drawings and EO did not specify a bonding strap at the lower avionics CB panel, as would be required when the panel is exposed to 115 V AC power; such as, when the IFEN 115 V CBs were added. Some of the discrepancies may reflect the lack of guidance in the data package. Wire routing varied from aircraft to aircraft.
The lack of complete and accurate installation information left decisions such as whether to install anti-chafing materials up to the installer. For instance, during TSB inspections of the installations on the other Swissair MD-11s, the PSU cables were found to be routed such that they came into contact with the edge of the fuel quantity data control unit located directly behind the lower avionics CB panel. This contact left indentations in the cable insulation. On some of the installations, spiral wrap was used to protect the cables as they passed the edge of the fuel quantity data control unit; spiral wrap was not observed in some other installations. As the approved data package did not describe the wiring installation within this area, no document change notices were created to record and account for variations in the wire routing. The IFEN PSU cables were at times routed behind aircraft wire runs prior to entering the conduit. For this reason, there was no way to accurately determine how the four IFEN PSU cables and 16 AWG control wire were routed through this area on the occurrence aircraft.
Following the SR 111 occurrence, the TSB monitored the FAA's full-scale fault insertion testing conducted on the IFEN system using specially designed test equipment. The testing involved introducing faults that would attempt to replicate conditions, such as multiple short-circuits, electrical over-current conditions, and cooling fan failures. In every case, the IFEN components performed as designed and did not produce excessive heat or show signs of wire or component damage. This work was carried out in a systematic way in a laboratory environment.
188.8.131.52 IFEN STC Project Management
The IFEN STC project involved nine companies and agencies: Swissair, IFT, HI, SBA, the FAA, the FOCA, Recaro, Rumbold, and SR Technics. For the most part, the management of the project was effective despite numerous errors and omissions in documentation. However, a notable exception where overall project management was less than effective was in accomplishing the proper integration of the IFEN with the aircraft electrical system, specifically as it related to emergency procedures.
Swissair contracted with IFT to provide an IFEN that would be compatible with the MD-11 and would be certified to existing standards. IFT did not have the necessary expertise to integrate and certify the system, which necessitated subcontracting to HI. HI could accomplish the design and integration of the system into the aircraft but was not authorized to provide the required FAA certification; consequently, they subcontracted this task to SBA. While the companies involved were assessed by the FAA as having the proper corporate credentials to accomplish the design, installation, and certification, there was a lack of specific knowledge within these three companies about the MD-11 electrical system and about how it was designed to function during emergency procedures.
Some two-party contracts contained contractual obligations with a direct impact on a third party. In some cases, the third party appeared to be unaware of these obligations. Moreover, assumptions were made by IFT and its subcontractors that type-specific information, both operational and technical, would be provided by Swissair. Likewise, assumptions were made by Swissair that IFT, through its subcontractors HI and SBA, possessed the technical and operational capabilities to provide a fully certified IFEN system.
In addition, there was a lack of clarity regarding which entity had overall project management responsibility. The FAA regarded the applicant, in this case SBA, to be responsible for the overall project management of the certification process. However, it was IFT, through its subcontractors, that was obligated to deliver a certified and integrated IFEN system to Swissair. The certification responsibilities were subcontracted through HI to SBA. As such, SBA was responsible for certifying the IFEN system; however, they had no substantive role in the overall project management.
The IFEN STC was a complex project with an ambitious schedule. It required a clearly identified project management structure designed and executed to track a myriad of details. To be effective, such a structure should have ensured that all the elements were in place to design, install, and certify the system to be compatible with the aircraft's type certificate.