TWA 800: two things nobody drew together

Twelve minutes

On the evening of 17 July 1996, TWA flight 800 pushed back from the gate at John F. Kennedy at about 8:02 and took off for Paris at about 8:19, with 230 people aboard, 212 passengers and 18 crew. At about 8:31, climbing through roughly 13,700 feet off the south shore of Long Island, the center wing fuel tank exploded. The airplane broke apart. Nobody survived.

The National Transportation Safety Board later described what followed as the most extensive and encompassing accident investigation it had ever undertaken. It took four years. The report was adopted on 23 August 2000, and its probable cause is a single sentence: an explosion of the center wing fuel tank, resulting from ignition of the flammable fuel and air mixture in the tank. The ignition source could not be determined with certainty. Of the sources the investigation evaluated, the most likely was a short circuit outside the tank that allowed excessive voltage to enter it through wiring associated with the fuel quantity indication system.

Read the shape of that sentence rather than its content. The thing that exploded and the thing that most likely lit it were in different parts of the airplane. They were designed by different groups, reviewed against different requirements, and drawn on different drawings. The accident happened in the space between them.

The first assumption: this circuit cannot light anything

A fuel quantity indication system measures how much fuel is in a tank with probes that behave like capacitors. The amount of fuel between the probe's surfaces changes what the circuit reads. Because those probes live inside a tank of fuel and vapor, the circuit that drives them is deliberately built to carry very little energy, so that even a fault inside the tank cannot deliver enough to ignite anything. That reasoning is sound. It was sound when the 747 was certified and it is sound today.

The gap was never in the circuit. It was in the wires that leave the tank and run through the rest of the airplane. Those wires do not travel alone. They are gathered into bundles with wiring from other systems, some of it carrying far higher voltage, and they share the same routes for long stretches. The NTSB report records that the 747 design required no special separation for fuel quantity wiring, including the probe wiring and the wiring that connects the probes, even though the wiring to the fuel pumps did carry protection. It also records that Douglas, designing airplanes under the same rules, required protected fuel system wiring to be isolated by at least three inches from other electrical wiring. Two manufacturers, one regulation, two different answers to the same question. Only one of them had asked it.

The FAA's own lessons-learned record for this accident states the assumption that was in force, in almost exactly these words: wiring for multiple systems could be bundled together without causing failures that could be catastrophic. Post-accident inspection of the fleet showed the assumption did not hold.

Investigators also found silver sulfide deposits on fuel quantity system components inside tanks. Those deposits matter because they change what the hardware does with the energy that reaches it, and offer a route by which a circuit designed to be harmless can become an ignition source. Two mechanisms, one conclusion. The safety property belonged to the circuit. The threat arrived through the wire. Nobody in the program owned the question of what that wire was lying next to, because the requirement that would have made it somebody's job did not exist.

The second assumption: an empty tank has nothing to burn

The center wing tank was nearly empty. The flight to Paris did not need that fuel, so the tank held only what could not be pumped out, estimated at around fifty gallons trapped in the structure, against a capacity of 12,890 gallons.

An empty tank is not the safe condition. It is the dangerous one. A full tank is mostly liquid, and liquid does not explode. An empty tank is mostly vapor, and vapor is what burns. What decides whether the vapor will ignite is its temperature, because warm fuel vapor at low pressure sits inside its flammable range while cold vapor does not.

The heat came from underneath. The 747 carries three air conditioning packs in an enclosed bay directly under the wing center section, which is to say directly under the center wing tank. On that afternoon two of the three, packs 1 and 3, had been running for about two and a half hours while the airplane sat on the ground in July. The NTSB later flew a similar 747 through the same sequence to measure what that does to the tank. In that flight test the temperature in the vapor space reached 145 degrees Fahrenheit just before taxi, and at the altitude where flight 800 exploded the vapor was estimated at between 103 and 127 degrees. Warm, thin and flammable.

Nothing failed here either. The packs worked. The fuel system worked. The flammability of that tank was not a property of the fuel system's design at all. It was a property of where the fuel system had been installed relative to something else, and it was at its worst in exactly the condition every airline wants, a full cabin kept cool on a hot ramp.

Two correct statements about two separate systems added up to an explosion, because the question that joins them had no owner.

Neither one fails alone

Draw the fault tree for a center wing tank explosion and the top of it is an AND gate. You need flammable vapor in the tank and you need an ignition source. Take either one away and there is no accident. Both branches were believed to be controlled, one by the people who designed a low energy gauging circuit and one by the people who decided the tank would normally be empty and, by implication, cool enough.

An AND gate is not a piece of arithmetic. It is a claim, and the claim is that the two inputs do not fail together. The arithmetic follows from the claim: you multiply two small probabilities and get a very small one, and that very small number is what goes to the regulator. If the claim is false, the multiplication is false, and the number is fiction in engineering notation.

What defeated the claim here was not one shared component. It was two separate pieces of geometry. A wire bundle in one part of the airplane, carrying the gauging circuit alongside circuits that could hurt it. A heat source in another part, warming the tank from below. Neither appears on a schematic of the fuel system. Neither appears on a schematic of the environmental control system. They appear only on a drawing of the airplane, and only if somebody is looking for them.

That is the whole job of a common cause analysis. It does not ask whether a part can fail. It asks what single thing reaches both of the parts you have just called independent. In the standard the industry uses today, ARP4761A, that analysis has three parts. Zonal safety analysis asks what sits together in each compartment of the aircraft and what each thing does to its neighbors. Particular risks analysis asks what an event from outside the systems, such as fire, lightning, a burst tire or an uncontained rotor, does to several of them at once. Common mode analysis takes every independence claim a fault tree makes and walks the ways two things believed to be separate can share a fault: a requirements or design error, a manufacturing or installation error, a maintenance or operating error, an environmental effect, a common external source.

The standard is explicit on the point that matters here. Independence assumed in a fault tree is a claim, and the common cause analysis exists to substantiate it, first in the preliminary assessment while the design is still open and again in the final one against the design as built. In those terms the packs under the tank are a zonal question, the shared wire bundle is a common mode question of installation, and both of them hang on the same AND gate.

Why the question was never asked

It is worth being precise about the failure, because it was not ignorance. Everyone involved knew what a common cause was. The question went unasked for three structural reasons, and each of them is still present in most programs today.

It had no owner. The fuel quantity group's requirement said low energy. The environmental control group's requirement said cool the cabin. Nobody's requirement said keep the vapor in the center tank out of its flammable range, because, as the NTSB found, the certification concept of the day relied on keeping ignition sources out of the tank and on nothing else. A question with no requirement behind it has no name on it. In the vocabulary of ARP4754B both of the statements this article opened with were exactly that, assumptions, and the standard's answer to an assumption is that it is captured, assigned and validated the way a requirement is. Neither of these was.

It had no page. There was no artifact in which the independence of "no ignition source" from "no flammable vapor" had to be written down, argued and signed. The tree said AND and the AND was believed.

It had no trigger. The airplane was twenty five years old. Wiring ages, insulation cracks, deposits form on probes, and none of that is a design change anyone reviews. The assumptions made at certification were never revisited against the airplane as it actually was in 1996, because nothing in the process made them come due. The current revisions of both standards expect the safety assessment to be revisited as the design matures and closed against the design as built. That expectation did not exist when this airplane was certified, and in our experience it is still the part most programs find hardest to deliver, not because anyone disagrees with it but because the design moves faster than the analysis can follow.

There is a date worth knowing. ARP4754, the guidance for developing aircraft and systems, was published in November 1996. ARP4761, its companion for the safety assessment, followed in December 1996. Neither was written because of TWA 800; both had been years in the making. But the process that makes the joining question mandatory, that names common cause analysis as a required part of the assessment and treats every assumption as something to be validated, was going to print while the wreckage was still being raised from the Atlantic. The 747 had been certified more than a quarter of a century before any of it existed.

No owner, no page, no trigger. Those three are the reason the accident lived in the space between two drawings, and they are the three things we set out to remove.

What Safety Lab does about it

Safety Lab Aero is built for the safety analysis of a design that is still moving. The arithmetic of a fault tree is not the hard part, and every tool on the market does it. The hard part is the claims the arithmetic rests on, and keeping them true while the design changes underneath them. TWA 800 is that problem in its purest form. Here is what the tool does with each piece of it.

The AND gate was a claim nobody had to defend. Every AND gate in every fault tree in the project is enumerated as an independence claim and handed to the common mode analysis, where it is challenged in words across the common mode types ARP4761A asks for: shared design, shared software, manufacturing batch, environmental exposure, common power, common cooling, installation and maintenance. Each claim carries a status and a finding, and a claim with no finding is visible as exactly that. The assistant that helps draft the challenge is instructed to start from the assumption that the independence claim is false and look for the evidence, and never to drop a candidate because it sounds unlikely. It sets a category aside only when it does not apply to the design.

The packs sat under the tank and nobody's drawing showed both. This is the zonal safety analysis half of the same common cause analysis, done per item rather than per checklist. Every item placed in a zone carries a threat record: what it gives off, meaning heat, fluid, debris, electromagnetic interference and vibration, and what it is susceptible to, each recorded for normal, abnormal and failed operation. Two items in the same zone are a co-location finding. An emitter in an adjacent zone with no substantiated barrier between them is a carry-over finding. When the threat is emitted in normal operation, the tool records it as a gap rather than a warning, because a hazard that is present while everything is working is not a failure case. It is the design. The packs are that exact case.

The assumptions were made once and never came due. Every analysis page records the design baseline it was done against, in a project where the current baseline is stated and every change to it is kept as history. A page stamped against an older baseline is flagged, and the thread that runs from each failure condition through its trees to its requirements says re-check. The analysis you did against last year's routing does not silently stay valid when the routing changes.

The last line of defense was a person. Where a failure condition's only defense is that the crew will notice, the tool raises it as a finding, and credit for crew awareness has to be substantiated with the alert class, the time available and the response required. The drafting assistant follows the same order in its own text: design it out first, safeguard second, inform the crew third. It is instructed never to offer crew awareness as the sole defense against a Hazardous or Catastrophic condition, and instead to name the design defense or say plainly that none exists yet.

We will not claim that software would have found the ignition path in a 1970 wiring bundle. What we claim is narrower, and we can stand behind it. The question that joins two drawings gets an owner, a page and a trigger. It is asked against the design as modeled rather than against a checklist, so a gate that appears in next month's revision arrives as an open claim rather than a silent assumption. And when the design moves, the answer is marked as belonging to the design it was given for, rather than quietly carried forward.

No owner, no page, no trigger. Safety Lab gives the joining question all three, and keeps them attached to the design as it changes.

What the regulator did about it

The regulatory response is worth reading as a sequence, because it is a public demonstration of how defenses should be ordered.

First came the search and the paperwork. Special Federal Aviation Regulation 88, issued in 2001, required holders of type certificates to conduct a safety review of the fuel tank systems of airplanes already in service against the ignition prevention requirements, and to write the maintenance and inspection instructions needed to keep the protective design features intact for the life of the airplane. Section 25.981 carries the underlying requirement in its current form: no ignition source may be present at any point in the fuel tank system where a catastrophic failure could result, and neither a single failure nor a combination of failures may create one, with lightning treated separately.

Then came the admission that this was not enough. The NTSB had already found that the certification concept of preventing tank explosions solely by keeping ignition sources out was not adequate on its own. In 2008 the FAA required flammability reduction in the high-risk tanks of roughly 2,700 airplanes already in United States service, with the passenger fleet to be retrofitted by 2016. In practice that means a system that feeds nitrogen-enriched air into the empty space of the tank until the oxygen falls below about twelve percent, at which point the vapor cannot sustain combustion whatever touches it.

The reasoning the agency gave for the second rule is the part worth quoting to any engineer who believes a thorough hazard hunt is a finished job. It said that unanticipated failures and maintenance errors will continue to generate unexpected ignition sources. It cited examples found after the SFAR 88 reviews had been completed, among them lightning related failures of probes on A320s and screws installed wrongly in a fuel pump housing. Its conclusion was that all possible ignition sources were unlikely ever to be identified and eradicated.

The order of defenses, as the regulator actually walked it:

• Tell people and inspect. Maintenance instructions, inspection intervals, configuration control limitations. Depends on everyone doing their job correctly, forever.
• Remove the sources. Go and find every way energy can get into a tank. Valuable, and shown to be incomplete by the regulator's own follow-up.
• Change the thing itself. Take the oxygen out of the vapor space so there is nothing left to ignite. The only one that does not depend on a person.

The order matters more than the finding

The standards do not rank defenses for you. ARP4754B and ARP4761A tell you to identify the hazard, classify it, and substantiate whatever credit you take against it, including credit for crew action, which has to be shown to be timely and recognizable before it counts. The ranking is engineering judgment, and this is ours. That sequence is why we hold a particular line in our own analysis. Design it out first. Safeguard it second. Tell the crew third. Crew awareness is a real defense and it belongs in the record, but it is never the only defense against a condition that is Hazardous or Catastrophic, because it puts the last barrier inside a human being who is having the worst day of their career.

The same logic governs how a common mode candidate is treated. It is never dropped for sounding unlikely. Failure rates are predictions about a world that has not happened yet, and a shared cause can easily be more probable than either of the independent failures it replaces. A wire bundle in a routing diagram and a pack running on a hot ramp are both extremely ordinary. That is precisely what made them dangerous.

Three questions to keep on the wall

• What single thing reaches both sides of this AND gate? Not what can fail, what is shared.
• What is next to this, and what does it give off while everything is working normally?
• If the answer to "what stops this" is that somebody will notice, what is the design answer?

Two hundred and thirty people were lost to a pair of statements that were both true. The gauging circuit really could not light anything. The tank really was empty. The accident lived in the space between two drawings, and the only thing that finds that space is somebody, or something, whose job is to go looking for it.

Next in this series: Nimrod XV230, and what happens when fuel and a hot duct share a bay that no analysis owned.

Sources: NTSB Aircraft Accident Report AAR-00/03, In-flight Breakup Over the Atlantic Ocean, Trans World Airlines Flight 800, adopted 23 August 2000. NTSB public overview of the TWA 800 investigation. FAA Lessons Learned record for Boeing 747-100 N93119. 14 CFR 25.981, Fuel tank explosion prevention. Special Federal Aviation Regulation No. 88. FAA final rule, Reduction of Fuel Tank Flammability in Transport Category Airplanes, 2008. FAA Fire Safety fuel tank inerting research. SAE ARP4754B, Guidelines for Development of Civil Aircraft and Systems, December 2023. SAE ARP4761A, Guidelines for Conducting the Safety Assessment Process on Civil Aircraft, Systems, and Equipment, December 2023. SAE ARP4754 and ARP4761 first issues, November and December 1996. Figures are United States government work in the public domain; the diagram is our own. Product statements describe Safety Lab Aero as released at the time of writing.