ATM Modernization, Commercial

Safety: Pink Slips And Brown Herrings

By David Evans | June 1, 2004
Send Feedback

A new advisory circular, AC 120-80, on in-flight fires rates a pink slip, according to Capt. Ken Adams. A Federal Aviation Administration (FAA) examiner gives a pink slip to a pilot who fails a check flight. "The pink slip basically takes away a pilot’s license until a successful recheck," Adams explains. Similarly, he believes a rewrite of this AC is in order.

AC 120-80 is an outgrowth of various National Transportation Safety Board (NTSB) investigations of in-flight fire events and of the Transportation Safety Board (TSB) of Canada’s investigation into the 1998 Swissair Flight 111 disaster. The NTSB issued various recommendations urging the FAA to issue an AC that stresses to aircrews facing an in-flight fire that they must take "immediate and aggressive action" to locate and extinguish a fire.

Adams participated in the Swissair Flight 111 post mortem as lead investigator for the International Federation of Air Line Pilots Associations (IFALPA). As such, he is intimately acquainted with the in-flight firefighting deficiencies revealed during the Flight 111 inquiry and of recommendations issued by the NTSB and TSB to improve the state of preparedness.

The resulting AC appears steadfast in honoring the NTSB’s intent. The words "immediate and aggressive action" are used no fewer than eight times in the 15-page document. It is also of interest that, while the AC is largely an outgrowth of the Swissair crash, it does not mention this case as one of the pre-eminent examples of how quickly undetected fire in a closed but ventilated space containing flammable material can turn into a raging inferno.

While an engine fire check list represents a straightforward drill, investigating and attending to an electrical fire of unknown origin has many other facets. Although not mentioned in the AC, these aspects include:

  • The need for the pilots to remain seated and fly the jet (yet be kept fully informed);

  • The spread of the fire once it gets a life of its own and the associated countdown time to loss of control;

  • The electrical consequences and the question of whether or not to quickly reduce to a minimal electrical power configuration—an issue as fundamental as turning off a gas stove in a domestic kitchen fire;

  • The aircraft configuration for approach and landing (for instance, how disabled is the aircraft?); and

  • Passenger anxiety or panic levels in the presence of unbreathable toxic air and/or the actual appearance of fire and smoke. Things could suddenly worsen in the cabin by opening smoke vents and cockpit sliding windows, or by switching air conditioning packs back on in an attempt to freshen cabin air.

Other aspects not mentioned include whether the fire can be fought. Or is it a ValuJet Flight 592 situation of burnthrough from another inaccessible compartment? Also, what are the consequences of switching air conditioning pack status and changing the ventilation patterns (venting the smoke, or closing the outflow valve, for instance)? Recall that turning off the cabin bus, and hence cutting power to the recirculation fans in the attic space above the cabin, had lethal consequences for Swissair Flight 111. The fire drawn aft reversed course and worked its way forward to the cockpit.

In the case of a suspected electrical fire, AC 120-80 does not emphasize the need to depower the airplane to all but basic flight-essential systems, as suggested by former test pilot John Farley:

"I would be pressing to sit down with the manufacturers’ electrical and systems experts to agree what services could be dumped ASAP after the smoke started or was smelled. I mean everything not essential to cruising towards the nearest diversion [airport]. That would mean hand flying on standby instruments with occasional use of a radio—every 15 minutes to check in, etc. Everything else would be switched off. I would then want to know the minimum I could switch on for a hand flown IMC [instrument meteorological conditions] descent and landing, depending on the destination weather."

Nor does AC 120-80 emphasize the need for integrated crew firefighting training in realistic scenarios. Finally, the AC does not address the new security reality-that cockpit doors are locked in flight. Thus, if the cabin-cockpit interphone system is knocked out, flight attendants can not open the cockpit door to report a fire situation to the pilots. It should be noted that the electronic locks on cockpit doors might also be frozen should electrical power be lost, as is often the case in electrical fires.

"This AC represents a start, but it falls short of the kind of detailed, consistent guidance and `best practices’ that the industry needs," states Adams. "A second edition of this AC can vastly improve upon its shortcomings." Adams is not one to beat the FAA about the proverbial head and shoulders with generalized grousing. His analysis is specific, and in subparagraph level detail.

Typically, problems develop rapidly and unexpected system failures may occur unrelated to fire. The AC mentions this problem, but only in passing—a sentence or two. For purposes of this discussion, the term "brown herring" may lend color and context to what aircrews may experience. This term is a variation of "red herring," an expression used to describe a misleading or irrelevant distraction. The phrase "brown herring" comes from classic military parlance, as in, "Captain, we have a dark brown smell down back."

Automation may exacerbate the danger. Electrical failure and fire burning through interrelated systems and interdependent components may take the challenge of operating the systems into a Twilight Zone lying lethally beyond the pilot’s perplexed musing, "What’s it doing now?" The term "electronic system nightmare" is featured in one of the pertinent examples of in-flight fire.

Maintaining flight control to "land ASAP" may be easier said than done. Any in-flight fire that is allowed to develop—through a combination of excessive troubleshooting and not powering down all non-essential electricals—already is out of control. At this unfortunate point, the real task becomes trying to establish when loss of flight control might occur and to act accordingly (e.g., accelerate descent, declare Mayday, etc.). As a rule of thumb, loss of control may be imminent when any two of five suggested factors have escalated to a non-survivable proposition. That point is defined with stark clarity as the point of zero return. Indeed, the AC could employ these factors to more strongly make its points to aircrews that they must not tarry. Rather, they should cut power to non-essential electrical systems and begin descent before the point of zero return.

The Point of Zero Return

When any two of the following factors are operative, the situation has escalated to a non-survivable proposition:

  • Unexpected systems failures and circuit breaker trips are happening so frequently that it is virtually impossible to cope logically with the changing considerations (i.e., the event is outrunning the brain’s ability to cope).

  • When things are happening so fast that the plan also must change frequently (e.g., from "Should we dump fuel?" to "No time for dumping; must get this airplane down now").

  • When answers from the cabin staff are not forthcoming and smoke, visibility and passengers’ breathing are starting to become paramount concerns. Pilots become aware that the cabin staff is using portable breathing equipment and handheld fire extinguishers.

  • When failures are uncharacteristic of the warnings (e.g., stick shaker actuated by a static port heater fire burning through a static line). AC 120-80 places this activity at the top of its indications of hidden fire: "Abnormal operation or disassociated component failures…may indicate a developing fire."

  • And when the existing divert plan/distance-to-run is suddenly looking non-viable due to an accelerating deterioration of the situation.

Examples of `Brown Herrings’

What is a "brown herring?" In short, it shows how rapidly problems can develop and how unexpected and varied system failures can occur, often involving warnings and alerts not necessarily signifying the system failures for which they were intended. Here are examples:

  • March 5, 2004: A B717 operated by AirTran Airways reported smoke in the passenger cabin during takeoff climb from Atlanta. At about 200 feet the No. 6 display unit on the captain’s instrument panel went blank and the engine alert display (EAD) left generator off alert displayed. The airplane had a complete electrical power failure and communications with the Atlanta Tower were lost. Emergency power was restored. The flight attendants advised the captain that there was smoke in the aft part of the cabin. The captain and first officer smelled an electrical fire. The captain returned to the airport and made an emergency landing. The bus-tie had failed to assure continuity of electrical power. Source: NTSB.

  • March 26, 2003: A B717 operated by AirTran Airways neared the final approach fix [for landing in New York City] and the master caution light illuminated; the left generator had failed. The display units (DUs), including the standby instrumentation, went dark. After loss of DUs, pilots noticed a burning smell in the cockpit. Emergency was declared. First officer reported that the DUs continued to flash in a random order. Upon landing gear extension, a message of unsafe landing gear commenced and continued until after the landing. The flight attendants noted that on approach, the cabin lights extinguished, and the emergency lights illuminated. After a short period of time, the emergency lights extinguished. The lead flight attendant noted that when she punched the buttons for the public address system, the buttons did not illuminate on the handset used for making announcements and for communicating with the cockpit. After landing, examination of the airplane revealed that the left side power conversion distribution unit, located in the forward electronics bay, exhibited evidence of sooting and had a burned odor. Source: NTSB.

  • From a 1991 incident report: After an emergency landing and as the aircraft passed a taxiway turnoff, the tower advised of fire on the left side of the aircraft. This was the first time the crewmembers were aware of a fire and is an example of an electronic system "nightmare." Prior to landing, the crew had to sort out 42 EICAS [engine indication and crew alerting system] messages, 12 caution/warning indications, repeated stick shaker activation, and abnormal speed reference information on the primary flight display. Many of these indications were conflicting, leading the crew to suspect No. 1 engine problems when that engine was actually functioning normally. There was no indication of fire presented to the crew although a fire actually existed. Source: Billings. C. E., (1996) Human-Centered Aviation Automation: Principles and Guidelines, National Aeronautics and Space Administration, Technical Memorandum 110381.

  • And on Oct. 4, 2003, a British Airways Concorde on initial climb after departure from Heathrow, a No. 1 air group "Air and Smoke" amber caution illuminated on the main warning system. The flight crew detected a slight smell, and some smoke was visible on the flight deck. Both the smoke and the smell cleared rapidly. The warning caption immediately reappeared, however. No smell or smoke accompanied the second warning. Some 30 minutes later, a No. 2 air group "Air and Smoke" amber warning caption illuminated, but this time there was no smell or visible smoke. The No. 2 air group was shut down, and the aircraft continued to its planned destination without further incident. The Concorde has since been withdrawn from service, so no further investigation was considered necessary. Source: UK Air Accidents Investigation Branch, Bulletin No. 4/2004n.

Receive the latest avionics news right to your inbox