This is the first of two cases in the docket for discussion. The second and deadlier case will be presented next month. Each illustrates the potential for greater safety through enhanced avionics.
The discussion here involves a widebody twinjet. The discussion to come will involve a twin-turboprop regional airliner. Both had onboard fires. Both were close to the airport. The larger plane landed with its aft belly hold filled with smoke, but no one was hurt. The smaller plane didn’t land; it crashed when the wing burned off and all 11 on board were killed.
Luck and circumstance separated the dramatically different outcomes. In both cases, improvements are needed.
The widebody case is the more recent, involving a May 13 fire in the aft belly hold of an Air Canada B767-300. The pilots received a fire warning light when they were some 10 miles from landing at Toronto on a flight from Vancouver. The crew activated the built-in extinguishing system and declared an emergency. The aircraft was met by airport firefighters after it came to a stop on the runway. The firemen, using infrared sensing equipment, did not detect any sign of fire, but when the door to the cargo bay was opened, smoke billowed out. Sure enough, when the firefighters crawled through the area, they confirmed that the fire had in fact been extinguished.
The design of the firefighting system may have played a fortuitous role–but only in this instance. Three bottles containing a total of more than 200 pounds (91 kg) of Halon extinguishing agent are installed in the B767-300. Nitrogen propellant distributes the Halon to the forward or the aft hold through tubing. At the first activation, an 88-pound (40-kg) bottle of Halon discharges to "knock down" any fire. In flight, after a 30-minute delay, the next two bottles activate to provide 195 minutes of suppression by metering a three-percent concentration of Halon. That concentration doesn’t extinguish a fire; it suppresses it until the airplane can get to an airfield and to firefighting assets on the ground.
Those two Halon bottles also were rigged to activate immediately upon touchdown, canceling the 30-minute delay. Hence, the fire on the B767 received a second massive "knockdown" dose of Halon about five minutes after the first dousing.
The fire was started by heater tape wrapped around water lines. Set aside the paradox of a fire starting right next to flame-suppressing water. In this case, a failed heater tape served as the equivalent of an arcing wire failure.
The ribbon tape is wrapped around water supply and drain lines to prevent their contents from freezing. In the Air Canada incident, the heater tape ignited adjacent flammable thermal acoustic insulation blanketing, which provided fuel for a conflagration that investigators found spread out from under the fire liner in the cargo bay.
Here are several observations and suggestions regarding the Air Canada incident:
Had the crew been an hour or more from landing, the outcome might have been different without that second total dose of Halon upon landing. Maybe, as in the case of engine fires, crews need the option of injecting a second massive shot of Halon if the first dose does not douse a fire in the belly hold.
In the case of an engine or auxiliary power unit (APU) fire, the crew can divert Halon from an engine not afire to one that is. Perhaps this sort of flexibility needs to be incorporated to fight cargo bay fires. The present arrangement seems geared to satisfying requirements for extended range twin-engine operations (ETOPS).
Second, in the case of an electrically stoked fire–in this instance involving heater tapes on the water lines–it is vital to remove all power from all circuits in the area of a fire. As the saying goes, electrical power feeds a fire.
Sources advise that arming the cargo fire system does not remove power from the water line heaters, only equipment cooling fans, chillers, etc. Killing all power to the holds is essential. Electrical fires can get a second breath after having been doused with fire suppressant the first time.
But if the power remains on the circuit, and the fire, although "suppressed," smolders from continuous electrical stoking and is propagated by the flammable blankets, it could burn through the outer skin. At that point, the three-percent Halon concentration drops to zero percent–with obvious consequences.
Third, the warning logic may need to be revisited. There are two highly sensitive optical smoke/fire detectors in each cargo hold on the B767. Normally, both sensors must agree to sound the alert. Should one detector fail and the other detect smoke, the crew only receives a white-colored status and maintenance message on the engine indication and crew alerting system (EICAS), not an alert in a more attention-getting color.
Rather than this simple system-failure notice, perhaps it would be better for the EICAS to display an amber cautionary alert. It might read something like, "System integrity compromised. Re-test the system."
What justifies such a modification? For one thing, a status message is not a warning. The crew might think, "Must write that up when we land," when in fact they should be thinking, "Do we need to perform a manual test to reconfigure to a single detector, because what we now have may in fact be a fire?"
But if the manual test is not done, they do not have an answer to that "burning question." The reason lies in the way the system is designed. Fire detector functioning is only checked during system power-up and during a manual test reset. If both detectors fail at any other time, there will be no indication of a fire until the system is subjected to a system-resetting functional manual test.
Indeed, the crew may be blissfully unaware of three things:
-
They have no smoke detection capability until–and unless–a manual test is performed, which automatically reconfigures it to a single detector system;
-
When the EICAS advisory appears, the manual test to regain a single detector capability is not currently part of standard operating procedure (SOP); and
-
The reason for the EICAS advisory is possible loss of a detector from fire in the belly hold, i.e., if the crew performed the manual test, they might suddenly have a fire warning come up.
The nightmare scenario is that the crew loses a detector, doesn’t realize (or recollect) that the system is normally configured such that two detectors must agree, and the fire burns away undetected.
Continuous monitoring of detector functioning might be better yet, with an appropriate caution message, amber light or aural tone displayed or sounded if detector failure occurs. This criterion also could apply to the small, dedicated blowers that draw air/smoke through the optical detector’s sensing orifice. No blower–no detection.
The problem again is that the system only checks blower operation during the power up or the manual test and will only display a status message. A simple current transformer could monitor the blowers, detecting if a blower is powered and that it has not seized. This type of continuous system monitoring, by the way, is featured on the B747-400.
Finally, step back and ask a larger question. Wouldn’t it be nice if the captain could say, "Fred, dial up the aft cargo hold on the closed circuit television (CCTV) and let’s look at what’s happening in there." Infrared (IR) cameras would help to precisely locate the fire in a smoke-filled compartment.
The second case, where the outcome was a fiery impact, also illustrates the virtue of CCTV. It, too, is a blunt indictment of an inadequate fire warning system. But that is the topic for next month’s column.
David Evans may be reached by e-mail at [email protected].