MD-11 Corrective Action Plan: A Case Study in Reactive Safety

There’s nothing like a fatal crash to concentrate attention on the surviving airplanes of the same model. The case at hand involves the MD-11, an airplane whose electrical wiring and interconnection system has been under the microscope since the Sept. 2, 1998, crash of a Swissair MD-11 from an in-flight fire ignited by arcing.

The examination, undertaken shortly after the crash, by Federal Aviation Administration (FAA) officials in the Los Angeles, Calif., aircraft certification office, shows that a sufficient number of latent hazards can add up to one very big and costly challenge. The resulting corrective actions can cost operators hundreds of thousands of dollars per airplane to complete.

Four airworthiness directives (ADs) issued on the same day with the same effective date of Dec. 14, and all of which, while different in the particular fix to be undertaken, feature the same imperative: to prevent “electrical shorting” and consequent “smoke and/or fire in the cockpit or cabin.” (See ASW, Nov. 22)

A review by ASW shows that ADs concerning the MD-11’s electricals have been coming steadily out of the FAA starting just a few days after the Swissair crash. The latest four, the last ones, bring the grand total to some 60 ADs on the MD-11’s electrical system. In the six years since the crash, the ADs have been issued at an average rate of 10 per year as part of a grand “corrective action program” based on a detailed service history review of the MD-11. It’s as if the airplane’s electrical system is being redesigned, an AD at a time, with an emphasis on wiring safety. By way of comparison, the Transportation Safety Board (TSB) of Canada’s final report of the Swissair tragedy noted: “A review of the MD-11 ADs issued by the FAA up to the time of the [Swissair Flight 111] accident identified … two ADs that were potentially related to either the area of the fire damage in SR 111 … or other smoke events in the cockpit.”

To be sure, after the accident FAA reviewers of the MD-11’s in-service history cast a wider net, identifying a broad range of electrically related deficiencies located throughout the airplane. Nonetheless, the contrast between two and 60 ADs is instructive. It shows the galvanizing impact of an accident. The contents of these ADs read like a glossary of electrical components: servo assemblies, terminal strips, connectors, circuit breakers, power feeder cables, support brackets, studs and – most of all – wiring. According to an FAA statement provided in response to an ASW query, “On Dec. 14, 1998, the FAA’s Los Angeles Certification Office took steps to ensure that no known wiring anomalies existed on the MD-11.”

“Even before the AD requiring MD-11 fleet inspection was published, the FAA, together with Boeing [BA], began investigating every in-service electrical wire chafing and arcing event known to have occurred on any MD-11,” the FAA said.

The reviewers had every reason to focus on wiring. Wiring failures have the potential to progress rapidly to catastrophic consequences. Follow, if you will, the progression of risk:

At the wire level. Insulation breaches, exposing conductor, can open the pathway to electrical arcing. The effects can range from the negligible to nuisance faults and can involve degraded function and eroded safety (the insulation representing the physical margin of safety protecting the circuit’s intended functioning).

Most wires are routed in groups (bundles or looms), hence failure at the wiring level may not be an isolated occurrence.

At the bundle level. Arcing between two wires buried in a bundle can increase the level of damage from two wires to dozens of wires, with melted conductor and charred insulation. Depending upon the number of systems to which the wires are connected, spreading damage can wipe out functions and force aircrews into emergency procedures. If not already tripped, circuit breakers may have to be pulled, smoke evacuation and fire fighting equipment put into action.

At the zonal level. Arcing damage that extends across multiple bundles can affect an entire zone – such as a cargo compartment or the wheel well, where electrical and hydraulic systems affecting landing gear, flap, slat and spoiler actuation systems are located. With multiple and sometimes seemingly conflicting failures, aircrews are faced with significantly increased workload and stress levels. Failures at the zonal level can completely negate fail-safe design and built-in redundancy features. The electronic and equipment (E&E) bay, typically located below the cockpit, is a particularly vulnerable zone for the sheer concentration of power feeder cables, signal wires and the end-use components to which they are connected. In this zone, wiring failure can quickly progress from bundle to the zonal level.

As an example, electrical arcing forced a United Airlines [UALAQ] B767-300 on a planned Jan. 9, 1998, ETOPS [extended operations] flight from Zurich to Washington, D.C., to make an emergency landing at London’s Heathrow Airport.

Investigated by the UK’s Air Accidents Investigation Branch [AAIB], the August 2000 final report captured many of the typical elements associated with in-flight electrical arcing and fires, progressing from insulation damage at the wire level to zonal level impact.

The speed with which wiring failure at the zonal level can threaten the entire aircraft can range from a fraction of a second to a few minutes.

At the airplane level. Arcing damage that extends across more than one zone can be catastrophic.

The TWA Flight 800 disaster is an example. In this 1996 loss of a B747 from an explosion of the flammable vapors in the center wing tank (CWT), investigators believe that a short circuit outside of the tank allowed excessive voltage to enter the tank via electrical wiring associated with the center tank’s fuel quantity indication system (FQIS).

While the source of this current was never determined, investigators noted a sudden spike in the number 4 engine’s fuel flow reading, the signal wire to which was co-located in the same fuselage bundle as FQIS wiring for the CWT. The National Transportation Safety Board (NTSB) investigation of the TWA tragedy observed, “The potential for short circuits to damage nearby wiring (more than 11/2 inches away) has been documented in Safety Board investigations of numerous accidents and incidents. The Safety Board concludes that existing standards for wire separation may not provide adequate protection against damage from short circuits.”

In the Swissair tragedy, electrical arcing in the overhead or “attic” space in the forward fuselage is believed to have ignited thermal acoustic insulation blankets and other flammable materials (see ASW, April 7, 2003).

In both cases, the initiating event was a tiny electrical spark, the one in the fuel tank destroying the TWA jet instantly, the one in the Swissair jet triggering a fire that led to spreading flame-front and loss of the aircraft in some 20 minutes.

The issuance of some five dozen ADs in the years since the crash shows that the MD-11 has been the subject of more ADs than any other transport category aircraft in respect to wiring problems and electrically-stoked smoke and fire threats.

The FAA has been unclear on the exact number, a table provided to ASW showing only 59 ADs while previous correspondence with the FAA indicated 64 ADs.

No matter. The number is big, and it raises a question: if all these deficiencies resulted from intense scrutiny, how many deficiencies might be found on other aircraft models by applying the same intense focus? Such an effort (which carriers could undertake on their own initiative, by the way) would represent the essence of proactive safety, preventing an accident before it happens rather than finding all the lurking hazards after the fact.

Partitioning the Program

FAA officials say the identified list of safety deficiencies was prioritized, resulting in the piecemeal implementation shown below.