1.   There were wiring faults in the MD11. Some were common to the aircraft type and some were due to the way in which a new Swissair Inflight Gambling and Entertainment System (IFE) was plumbed into the existing electrics. The way in which it was done meant that the pilot’s checklist for smoke was not going to address (early enough) what was likely to be the major cause of the building conflagration. Because of the Canadian investigator’s concerns the FAA has issued a 1999 AD (mandatory US Airworthiness Directive) requiring these installation faults to be double-checked.

2.   The MD11 (and about 65% of other airliners flying today) are wired with Kapton wire (aromatic Polyimide insulation). This wire is light and flexible when new but ages very poorly (embrittles and cracks). It cannot turn sharp corners. When its electrical integrity is compromised (i.e. it shorts out) the outer sheath turns to a carbon char, a highly conductive material that can cause whole bundles (looms or harnesses) to combust along their length. Frequently circuit-breakers can fail to trip and safely cut power.

3.   The MD11 (and MOST of the other airliners in the world) are lined throughout with a metalized mylar thermal acoustic insulation. For years the FAA insisted it was safe because it passed their oversimplified combustibility test. They rejected over many years the mounting evidence provided by many fires (including very damning evidence from the Chinese) that the insulation was highly combustible and unsafe. Boeing had (in 1997) issued a non-mandatory Safety Bulletin urging its replacement, now the FAA has issued an AD requiring US airlines to replace it. The fact that Kapton wire runs through, over and under this stuff makes for a lethal combination.

4.   The traditional smoke-in-the-cockpit checklist actions require the flight-crew to gradually power down the electrics, starting off with the non-essential stuff (galley and cabin busses) and working through it until they nobble the cause (and hopefully then the smoke stops). In reality it’s hard to determine the source of an elec fire and its even harder to discriminate when it’s dissipating (because you’ve got a mask and goggles on). Meanwhile the fire (particularly in the case of Kapton wired aircraft) can gain in intensity and the metallized mylar insulation can be smouldering and propagating the fire in all directions under the cabin lining. To complicate matters further, the MD11 checklist calls for the pilot to firstly check that the smoke is not emanating from the airconditioning system. To do this lengthy checklist first means that the Smoke and Fumes of unknown origin (electrical) checklist will be delayed much longer (and the fire will intensify).

5.   When the pilots don their two-piece smoke masks and eye goggles they are then umbilically tied to their seats. The checklist also prohibits them from leaving their oxy supply (for obvious reasons – smoke is toxic and can rapidly debilitate or even incapacitate). In older conventionally crewed aircraft (such as the B747 Classic) there was a third crew member who could take a portable oxy bottle and wander the aircraft, fight a galley fire, look under floor hatches, reach circuit-breaker panels, inspect wings and tail etc. The MD11 was a direct development of the DC-10. It was the first aircraft to utilize computer-driven Flight Management Systems to automate the Flight Engineer’s system switching and fuel management tasks - and so eliminate the costly third crew member. Unfortunately the irony of it all is that this robotic Flight Engineer is electrically powered and highly susceptible to the modern airliner’s greatest threat – its near total reliance upon electrically driven computers and a complementary lack of any electrical wiring redundancy. In the electrical fire scenario, reliance upon a computer-driven, automated, trouble-shooting systems manager is very much like relying upon a fire-engine that is itself on fire.

6.   If you’ve read Neville Shute’s novel "No Highway in the Sky" you’ll appreciate that an airliner is a particularly vulnerable means of mass transportation (i.e. vulnerable but not necessarily risky). If a catastrophic structural failure took place, well that’s life. However airliners are cyclically proof-tested to ultimate destruction to demonstrate that this is a highly unlikely eventuality. What about its systems? Many modern airliners are fly-by-wire controlled which means total reliance upon hydraulics. These hydraulic systems are triplicated and have no commonality in their pipes, hoses, pumps, reservoirs and accumulators. Avionics (GPS,INS,comms,ILS,VOR) are mostly triplicated; there are two pilots and they have regular stringent health checks. What about electrical systems? Well each engine has a generator and the electrical distribution system is via a number of busses, each of which segregate increasingly essential sub-systems. As well as that there are air-driven generators that can be deployed into the airstream. What about the aircraft wiring? No, sorry about that, that is admittedly the weakest link in the system. It’s built into the aircraft at birth and, although it’s often spliced into, continuity tested and "inspected", a lot of it is inaccessibly routed through bulkheads, conduits etc. It’s also bundled together in large looms that make it both impossible to inspect and a greater hazard. The mere act of disturbing ageing Kapton wire can induce the sorts of insulation failures that can lead to arc-tracking. Because there are hundreds of kilometres of wiring we cannot afford to duplicate/triplicate that, it would mean lost payload over the whole revenue life of an airframe. But isn’t wiring foolproof? Unfortunately, but no-one wants to admit it, Kapton wiring was particularly foolhardy- most electrical wiring experts see it more as a fuse than a wire. The military of many nations have ripped it out of all their aircraft because of losses due to electrical fires. Other Air Forces (like the RAAF) know full well its devastating potential and have hard and fast rules for aircrew and maintainers. Why don’t the airlines just replace Kapton? The short answer is that it would be cheaper to buy a new jet. Is there a cover-up? Just think about the massive costs of grounding Kapton-wired aircraft – you betcha there is a cover-up. In fact it’s one of those distinctive consensual cover-ups where the problem is so encompassing that it would be political suicide to even express an opinion. So what is being done? The regulators are controlling the statistics, ridiculing the media, suppressing the facts and collectively keeping their fingers crossed. If luck continues to be on their side the problem will go away in about ten years. By that time these (by then) geriatric jets will be in the hands of Third World operators – and we all know that their crashes are generically due to incompetence or poor maint. In fact the typical wiring crash is a high-speed smithereening event that leaves little conclusive evidence behind. There is a lot of scope for convenient facile explanations such as oxygen generators (Valujet 592).

7.   Why haven’t there been more wiring-caused crashes? Well who says there haven’t been? Valujet 592 had a long history of gross electrical failures, even on the flight before its crash. The oxy generators no doubt fuelled the fire but its cause is widely considered to have been electrical fire. The NTSB report is shot full of holes and rampant with obfuscation. TWA800 is portrayed as a centre-section fuel-tank explosion (but that explosion had a wiring trigger). The similarities between the Silkair B737 crash in Indonesia and the Swissair accident are uncanny. In both cases the cockpit voice and digital flight data recorders cut out well before their high speed dives into the deck. No-one would have believed suicide in the Swissair crash but the Silkair Captain was evidently a colourful rogue – so why not suicide – it has plausibility. As well as the well known disasters, the record is replete with many instances where it was either a freighter (so no pax casualty figures) or a near miss. However the NTSB data-bases are biased toward US incidents and are admittedly incomplete. Military crash reports tend to be kept in-house. All in all the manufacturers, airlines and regulators have done a good job in suppressing the length, breadth and depth of the problem.

8.   Airline pilots have always been dissatisfied with the fumbling two-piece smoke and goggles personal breathing equipment(PBE) they are expected to wear. The goggles mist up, they inhibit peripheral vision and the masks seal poorly over beards. Once in their masks pilots can’t talk normally cross-cockpit and are prone to run the yoke-switch (for intercom) the wrong way and transmit on radio. In fact that turned out to be a good clue (for the investigators) that the SR111 pilots had gone dutifully into the aircon smoke checklist first. What sort of smoke-masks should pilots have? Quick-donning full face masks solve sealing problems, don’t mist up (like goggles) because of the oxy inflow and can have a permanent-mount focussable light atop the forehead. You may not be aware that the drop-down masks are the passenger’s oxy supply in the case of explosive decompression at height. They provide no protection against toxic fumes.

9.   There are three partial solutions to visibility problems in dense continuous smoke:

1. A high-intensity focussed light can penetrate thick smoke much as fog-lights penetrate fog. If it’s mounted atop a smoke mask it will follow the pilot’s gaze.
2. Venting the smoke can be an answer. Once the aircraft is down to lower levels (and depressurized) a sliding side window (or smoke vent can be opened to suck out the smoke via venturi action). But if it’s a cabin fire, this will tend to suck a lot of smoke forward into the cockpit.
3. The EVAS device interposes a plastic bag full of clear filtered air between the pilot’s eyes and his instruments and windshield. This was approved by the FAA many years ago but never mandated for use. Ironically, following their last total loss of an airliner in Zurich (due to smoke in the cockpit) Swissair expressed an intention to install EVAS. Unfortunately the bean-counters convinced the airline’s management that a high-tech gambling and entertainment system would do more for their balance-sheet’s bottom line. Amazingly there is an FAR (Federal Airworthiness Regulation) that requires the FAA to resolve the problem of dense continuous smoke. They have simply decided not to enact or enforce it (it would cost too much money as per their cost/benefit analysis guidelines).

10.   There is one existing "sure-fire" (pun intended) solution to dense continuous smoke. In a way it is simplistic. Yet in simplicity there is often truth. If you look at the fuselage fire figures you will see that (disregarding bombs) historically 30% of fires have been due to cargo hold events (HAZMAT), 20% due to discarded cigarettes and the rest have been attributed to run-amuck electrical events. Now the cargo-hold fires have been almost completely resolved by rules, security checks, containerization, smoke-detectors and fire-suppressors and the smokers have been banned from lighting up. That leaves electrical fires as roughly 100% guilty from here on in. The traditional, protracted two-checklist approach (aircon then elec) to fighting electrical fires is in itself a killer. Aircon smoke can be a bit sickening – but it won’t kill you. The airlines have notionally acknowledged this (since SR111) by informally telling their pilots to forget about checklists and land ASAP. Some have covered their butts by simply relegating checklists to second priority. Indeed, that is good advice. In hindsight perhaps it would have been a life-saver for SR111 (no orbit, no fuel-dump, just dump the gear and land). However electrical fires are insidious events. They start off as a waft, then a smell, then an acrid odour – well before there’s any visible smoke. Pilots are well versed in trouble-shooting techniques. It is second nature for them to confidently launch into a checklist in order to sort out systems and resolve failures. It is, after all, what is drilled into them in their simulator sessions. Unfortunately the simulator sessions cannot simulate the disabling environmentals of a developing elec fire. At best a short-duration smoke cannister will set the scene, but simulator sessions normally wind up with a "solution" or a cease-fire discussion of the considerations. They are, as I heard one pilot describe, "about as useful and realistic as phone sex". There is no simulator "staff solution" to the insoluble raging fire. Compounding the quandary is the fact that large underwing turbo-fans have very poor ditching characteristics. If you’re oceanically a long way from an available airport you really do need a better solution.

11.   What about non-existent solutions? Have you heard about the Virgin Bus? In each aircraft there are a number of systems that are absolutely essential and some that are just desirable – and many that are simply dispensable (seat-back TV). Most of these are electrically powered, some (eg hydraulics) are simply electrically switched and controlled. If, instead of time-consuming trouble-shooting, pilots were able to simply switch to a previously inert "Virgin Bus" that would power essential "get-you-home" systems, would that not be a saner solution? Why, you might ask? Well, any wiring expert will tell you that priority number one is to get the power off the Kapton wiring. Priority two is to keep it off the Kapton wiring. Priority three, now that the fire is minus its stoking electrics and you’re going to survive, is make the best of what you’ve got left. Presently that’s not a lot. The Swissair Chief Pilot Hiltebrandt said, shortly after the crash: "Complete loss of electrical power is unthinkable". In my advocated scenario it’s not unthinkable, it’s desirable. Kapton wiring insulation has been replaced, in recently built airliners, by teflon coated Kapton (TKT), a very safe insulation with a very low toxic smoke output (5% versus 95%). If older (and new-build) airliners incorporated a TKT-wired virgin bus there would be (for once) true redundancy in airliner electrical wiring – a fall-back position sans pareil. The A to Z advantages of this solution were published in the aviation industry’s Air Safety Week Vol 13 No 4 (Jan 25, 1999). In the MD11 setup the Smoke switch was designed to disable (and then, as you rotated it to the next position, restore) generators, busses etc, one system at a time. It relied upon a pilot being able to determine (by system behaviour and smoke dissipation) which was the benign selection. If he got it wrong he restored power to the fault and the fire escalated. That system was not designed to cope with wiring flaws, it simply isolated failures in powered devices (busses, generators, bus-tie switches, regulators, inverters etc). The Smoke switch design, metallized mylar thermal acoustic insulation, Kapton and foolish checklists were a lethal combo. It just needed the IFE trigger and another event that you can read about here. In every accident there is a chain of causation. Many accidents do not occur (or are simply incidents) because that chain is incomplete. In SR111 the chain was so inextricably interlinked you could callously call it a dragging homicide.

PROBABLE

1. Some inconclusive evidence of an oxy blow-torch effect (when the burning wiring loom above the cockpit/cabin bulkhead melted into the jump-seat oxy supply tube) has been found. Molten aluminum was found and globules of melted plastic were on the recovered jump-seat covers. Routeing of wiring looms adjacent to (or over) High Pressure (2000 psi) oxygen tubing supplying flight deck regulators may have led to the final catastrophic developments. Whether this would have rapidly depleted the pilots’ oxygen supply (coming from the same bottles) is a matter for conjecture. However you can reasonably speculate that a combination of oxygen depletion and the oxy blowtorch creating greater levels of toxicity in the flight-deck air would be a prescription for pilot incapacity and loss of control. Up to this point (from the CVR) Captain Zimmerman’s inspiratory rate was just below hyperventilation levels. When the catastrophic development occurred that caused both pilots to simultaneously declare an upgrade "emergency/ must land immediate", copilot Loew’s rate also increased exponentially. You had a situation in which both pilots were already approaching the limits of their coping levels and then were overcome by insuperable developments. Any solutions must address the overtasking of a two-man crew when they are in extremis. Simply resolving an IFE wiring fiasco does not address the deficiencies inherent in the coping levels of a two-man crew in an escalating emergency scenario (aka task saturation).

3.   An aviation safety group known as IASA (International Aviation Safety Association) is being funded by Lyn Romano, the widow of Ray Romano (a victim of SR111). She will be using the funds derived from forthcoming litigation. One of IASA’s aims will be to uncover the cover-up. Its first 1998 initiative was an admonition to another National carrier who operates the MD11. Quite incredibly that very prestigious National Airline responded responsibly and is working with IASA’s Dutch representative toward ensuring that what happened to Swissair Flt 111 is not a repeatable threat. Given the amalgamating power of the Internet, airlines, regulatory authorities and manufacturers may find it easier in the long run to cooperate and incorporate sensible safety measures – rather than face an increasing barrage of factual revelations that portray them in a poor light. It is common knowledge that Boeing’s fortunes are in decline and Airbus is in the ascendant. They both make quality products but if they need a competitive edge they may well find it in their public attitudes towards safety enhancements (smokehoods for passengers, rearward-facing seats, EVAS for flight-deck crews, the virgin bus). At present passengers are totally distracted by the lure of cut-price ticketing and Congress is concentrating on Passenger's Rights. These are irrelevancies when viewed against the backdrop of deteriorating post-deregulation safety standards. If the growth of air travel increases at the predicted rate we can expect, after 2005, a disastrous crash every other week, interspersed with one or two quite off-putting near-calls. That will tend to concentrate minds more upon mortality and lethality. Airline accidents will always occur – but avoidable accidents need not.

4.  Unlike homicide, in aviation accident investigation you can only show probable cause, not motive. But there is a motive behind many airline accidents - it's expediency. The paramount  imperative of airline maintenance is to keep airframes in revenue service - they are frequently scheduled for 15 to 18 hours of each and every day. Which brings me to this sad fact...It is probable that the decision by Swissair Maintenance on 4 Aug 98 to replace one of the aircraft's two bus-tie sensing relays across their entire MD11 fleet was the root cause of the accident. They'd had a fire in one of their MD11's on the ground in Bangkok the day before and a faulty bus-tie switch was the cause. It seemed in the best traditions of Swissair safety to have that changed over in the whole fleet. However another good old saw is that: "If it ain't broke, don't fix it". That's why most airlines and air forces [decades ago] gave up on removing functioning items for bench-checking and reinstallation. The emphasis nowadays (particularly in avionics and electronics) is on BITE (built in test equipment). Some devices (like generators) cannot come on line unless their frequency and volts are within fine tolerances. Anyway the electrician who replaced the SR111 aircraft's bus-tie "murphied" the installation and when power was applied there was a massive short. Unfortunately once things were rectified, only functional checks with all generators, busses and engines running were carried out. In a KAPTONIZED aircraft you've got to look further than that because that short could well have (and most probably did) become the thin edge of the wedge. One characteristic of electrical shorting is that wiring insulation and component damage can occur well downstream. In SR111 the arcing obviously went on for almost a month before pyrolization was triggered and became its characteristic self-propagating phenomenon. The rest of the story we know....