1 The Incident as a Situational example

En route to Europe at FL 330, the flight progresses normally with the captain as pilot flying (PF). Both pilots detect an unusual odor in the cockpit and begin to investigate. After agreeing that it is coming from the air conditioning system, they crew find there is smoke on the flight deck but not in the cabin.

What would your reaction be?

The first officer issues an urgent PAN PAN message to air traffic control (ATC) and announces the intention to turn back. The crew is informed by the controller of a closer airport.

What would your strategy be with regard to the landing?

The pilots elect to divert to the closest airport. They don their oxygen masks. ATC clears the airplane for a descent to 3,000 ft. However, they need more time to dump fuel since they are on the first quarter of the flight. After following ATC directions, the airplane levels out at 10,000 ft, and the crew ask to be notified when they can dump fuel. The autopilot is disengaged.

Suddenly the controller hears both crewmembers declaring an emergency over the radio and announcing that they have to land immediately. One minute later, radio communications and radar contact are lost. Five and a half minutes after that the airplane is destroyed by impact with the sea. There are no survivors.

2 Data, Discussion and Human Factors Involved in this Situational Example

The time between initial detection of the unusual odor and the airplane striking the sea was around 20 min. The accident report focused on determining the cues available to the crew and the factors affecting their assessment of the situation.

An event — presumably an electrical arcing on a power supply unit cable on the in-flight entertainment network — occurred at some point. This ignited nearby flammable materials, which developed into a full in-flight fire, starting above the ceiling on the right side of the cockpit near the rear wall. The fire spread and grew quickly until it degraded the airplane systems and the flight deck environment. The resulting loss of control of the airplane led to the impact with the sea.

There were no built-in smoke and fire detection and suppression devices in the area where the fire started. They were not required by the regulations, and their absence delayed the identification of the fire and allowed it to propagate without crew knowledge until it was out of control.

The crew had to rely on smell or sight alone to detect and differentiate between several potential sources. They mistakenly diagnosed the initial odor as coming from the air conditioning system. There was no in-flight fire fighting procedure or training on aggressively locating and extinguishing a fire. Instead, the crew, following the appropriate procedure in place at the time of the accident, concentrated on preparing to divert and land.

The captain was an instructor pilot on the airplane and was known as someone who created a friendly yet professional atmosphere on the flight deck. He worked with precision and gave detailed briefings. While conducting training sessions on “smoke in the cockpit” to trainees, he explained all the steps and consequences of using the “electrical and air smoke isolation selector.” The first officer was considered very well qualified, focused, open-minded, calm and assertive when needed. Although having fewer flight hours than his captain, he was also an airplane type simulator and transition instructor.

Both pilots were in good health and well rested. The flight preparation was uneventful and very professional, without any rush to the airplane. The crew’s circadian time was kept close to their destination and not considered by the investigation report as a factor in the occurrence.

Crew communications showed that the situation was not evaluated as an emergency until about 6 min before impact.

The training the crew received was in line with normal training regulations and standards. It did not prepare them to identify and fight an in-flight fire. Instead, pilot training focused on eliminating the threat from smoke (either from the air-conditioning system or from an electrical source) by following a dedicated check list. It was never anticipated that the crew would actually have to fight a fire in the cockpit ceiling, and crews were not trained to assess how quickly a fire could develop into an uncontrollable situation.

At the time of the accident, it was commonly agreed that crews would be able to distinguish between smoke coming from the air-conditioning system and smoke coming from an electrical failure. Once this was established, the crew would choose the appropriate checklist to follow. However, this expectation would prove tragically wrong. Human sensory perception is not capable, especially without adequate exposure to real fires during training, to consistently differentiate between smoke coming from an electrical fire, the air-conditioning system or the by-products of the combustion of other materials. None of the fire-fighting training included a fire on the flight deck, consistent with industry standards that specify that the cabin crew fight the fire so as to allow pilots to continue flying the airplane.

2.1 Factors affecting decision making

The crew observed a small amount of smoke entering the flight deck from the rear and above, then disappearing and reappearing a few minutes later close to the right overhead diffuser. This contributed to their belief that the smoke was coming from the air-conditioning system. During other pilot interviews conducted in the investigation, none were aware of the presence of flammable materials in this area of the ceiling. They would not suspect the area to be the possible location of a fire threat. Nor was there anything in their experience to suggest that the smoke could be associated with an on-going, uncontrolled fire of flammable materials above the ceiling.

Having accepted that the smoke was coming from the air conditioning system, there did not appear to be an immediate threat to safety that could be mitigated through isolation procedures. The level of smoke being relatively low, the pilots’ risk assessment led them to conclude that it was not a critical emergency worth taking the additional risk of an immediate emergency landing. Therefore, they established priorities consisting of obtaining the information needed for a diversion to the appropriate airport. There was no indication that the crew started the Air Conditioning Smoke checklist immediately. The pilots donned their oxygen masks around 5 min after detecting the smell.

Based on their perception of the risk as low, the crew initiated an expedited descent rather than an emergency descent and landing. Since they were unfamiliar with the diversion airport, they took their time to familiarize themselves with it. In addition, a meal service was being made in the passenger cabin at that time and no smoke was reported by the cabin crew. The flight deck crew considered it to be a greater risk to conduct an emergency descent without the cabin being prepared and without the airplane being prepared for a stabilized approach. Furthermore, the weight of the airplane was known to exceed the maximum landing weight limit for non-emergency conditions.

When the crew selected the Cabin Bus to the “off” position, as the first step in the check list, the air flow reversed direction toward the front of the airplane, fueling the fire with additional air. The fire spread rapidly above the captain’s seat, melting the ceiling liner. Traces of melted aluminum were later found on the carpet. The visibility in the cockpit worsened very rapidly.

The crew oxygen supply line was located near the fire. It is not known if it contributed to the fire, but testing of the oxygen cap assembly during the investigation showed it could not sustain the heat generated by the fire. It was assumed that it failed during the latter stages of the flight.

The air flow directed the fire further to the front of the airplane, between the captain’s rudder pedals into the avionics bay, generating a rapid succession of multiple system failures. The avalanche of fault messages, alerts, klaxons and master caution lights must have been extremely confusing to the crew and almost impossible to cope with.

There were indications that the crew cycled from air data computer no. 1 to no. 2, indicative of a typical recovery action when flight instrumentation and displays are lost. Fuel dumping was stopped, and the no. 2 engine was shut down, probably due to a false fire warning indication caused by the cockpit fire reaching the wiring. When those systems failed altogether, the crew was left without accurate means of establishing their position, to navigate to the airport or to communicate with ATC.

The first officer’s seat was occupied at impact. The captain’s seat position was in the egress position but it is not known if it was occupied. If the pilots were not incapacitated and were still trying to fly the airplane, it seems they had lost orientation at the time of impact because debris analysis suggest the airplane hit the ocean with a 20-degree nose down and a right bank in excess of 60 degrees.

The investigation report showed that there was no single cause to this accident, but several contributing factors combined that led to the final outcome. These factors are summarized below for the sake of completeness, as we focus on human factors issues. Organizational and design factors — crew training, flammable materials — were also among the latent failures that led to the accident.

2.2 Active failures

• Flammable materials, ignited by an electric arc, spread a fire that started in the ceiling of the flight deck. The fire intensified to the point it degraded the systems and flight deck environment so much that the crew ultimately lost control of the airplane.
• No smoke and fire detection and suppression systems were installed in the area where the fire started, and this allowed the fire to spread without the crew knowledge, up to the point it became uncontrollable.
• Reliance on sight and smell proved inadequate to differentiate and identify the source of the smoke. This resulted in the misidentification of the source of the smoke, and the associated inadequate risk assessment led the crew to the wrong check list.
• In-flight fire fighting was neither indicated in flight crew procedures, nor part of crew training.
• The crew lost control of the airplane due to multiple system failures, aggravated by cockpit environment conditions.

2.3 Latent failures

• No fire-induced failures were considered for the system safety analysis required for certification.
• Airplane certification standards for materials flammability were inadequate.
• Regulations did not require design and completion of checklists for isolating smoke or odors associated with overheating conditions in a time that minimizes the risk of propagating an in-flight fire.
• The in-flight entertainment network supplement type certification process did not ensure that the system was compatible with the aircraft’s electrical system.

3 Prevention Strategies and Lines of Defense

The investigation report listed a lot of recommendations on the wiring, thermal acoustic insulation materials, smoke detectors, video camera monitoring, halon distribution systems, oxygen system and air conditioning improvements, in-flight entertainment systems, circuit breakers, stand-by instrumentation, certification process, and flammability standards.

We will focus in this section only on the prevention strategies associated with human factors.

Flight crews need to be provided with an in-flight firefighting plan that includes procedures, checklists, equipment and crew training. Early detection and an emergency landing in less than 20 min saved the lives of another crew two years later in a similar case of in-flight fire, though it was not in the cockpit.

Improve in-flight fire fighting training, procedures and checklists

Awareness of crew resource management (CRM) and its associated training has been improved, as has crew selection and knowledge verification. Flight manuals, checklists and emergency procedures have been reviewed and updated. Furthermore, procedures for entry into service of new aircraft have also been improved.

Improve CRM training and technical knowledge

In addition to new procedures, better training and CRM, design and systems interfaces also were improved. Access to difficult-to-reach areas to permit fire fighting has been improved.

4 Summary of Key Points

After 53 min on a transatlantic flight eastbound at FL 330, the crew smelled an abnormal odor. They diagnosed the origin as being in the air conditioning system and 13 min later, the flight deck was filled with smoke. The crew sent the international urgency signal and was cleared to divert to the nearest airport. While approaching the airport, the crew declared an emergency, and several minutes later the airplane struck the sea at high speed. The airplane was destroyed, and there were no survivors.

Understanding the complete picture underlying why this accident occurred can prevent other crews from falling into similar traps.

• Risk assessment is critical for early detection of in-flight fire as well as fire fighting training, procedures and checklists
• Adequate crew communication as shown in CRM is a critical contributing factor to risk reduction

5 Additional OGHFA Material

Briefing Notes:

• Crew Resource Management

Checklist:

• Decide - Checklist

Situational Examples:

• Unidentified Fire On Board

Related Skybrary Articles

• Fire in the Air;
• Crew Resource Management