Standards for Aviation Fire Safety
Unlike grain elevator safety, aviation safety is an entire field of regulation. While the major hazards in a grain elevator can be addressed in a single standard, there are clusters of standards around each of the major aviation hazards. Navigation, aircraft integrity, equipment maintenance, and fire safety each accounts for a myriad of standards, both public and private. Perhaps the most accessible standards, given their familiarity on the ground, are those for fire safety. Even here, the array of regulatory issues is overwhelming. There are at least four facets of fire safety—prevention, detection, suppression, and evacuation—and each accounts for a multiplicity of standards. Suppression, for example, involves standards for fire extinguishers as well as flammability requirements for seat cushions and building materials. The regulatory territory can also be divided by location in the aircraft. The galley, the cabin, the lavatories, and the baggage compartment all pose special conditions that occasionally merit separate standards.
Out of this complicated maze of potential topics for regulation, public standards tend to emerge from specific accidents. The "Airplane Cabin Protection Rule" examined in this chapter stems directly from the Air Canada fire in 1983. The standard covers fire extinguishers and smoke detectors. On the private side, standards evolve quite differently. The number and scope of those developed by the National Fire Protection Association is controlled by the organization's Standards Council in conjunction with the Correlating Committee on Aviation. NFPA
does not have a standard for aviation smoke detectors; but it does have a standard for aviation fire extinguishers. That standard is compared to the FAA regulation in this chapter.
Many of the propositions borne out by the standards for grain elevator safety are contradicted by the standards for aviation fire safety. In some respects, the NFPA standard is better than the FAA's. It is rooted in a technical understanding of fire detection and suppression, and it avoids some of the pitfalls of the FAA regulation. Surprisingly, the NFPA standard requires more fire extinguishers than its public counterpart. That does not necessarily make it better. It is doubtful whether the benefits of this standard exceed the costs. Most remarkable, given the common perception that concerns about cost dominate private standards-setting, is the absence of any arguments to this effect by NFPA committee members.
Compounding the curious juxtaposition of this demanding private standard and the lenient one for grain elevators is their common origin: both were written under the auspices of the National Fire Protection Association. Apparently, NFPA is capable of producing standards ranging from almost spineless to possibly too stringent. The NFPA standard examined in this chapter also changed dramatically over time. It was stringent when first adopted in 1956, languished and became outdated some twenty years later, but was revitalized in 1980 to its stringent, possibly unreasonable, form. These differences across NFPA standards and over time suggest the importance of influences beyond institutional design and administrative procedure. Three influences are identified through this case: (1) the professionalism of fire safety engineers, (2) the tangled web linking this standard and UL's generic standard for fire extinguishers, and (3) the peculiar political culture of aviation safety.
On the public side, the standard described in this chapter shatters the popular image of federal "notice and comment" rulemaking as burdensome and time-consuming. The FAA adopted it less than a year after it was proposed. There were no lengthy hearings, no subsequent judicial appeals. Although the FAA standard suffers from failure to take certain technical realities into account, it is unquestionably strict, like many aviation standards, and arguably unreasonable. These unexpected outcomes, both public and private, suggest that regulatory behavior can be quite issue-sensitive. Cultural attitudes about the risks of flying are, to say the least, peculiar. Apparently no risk is acceptable so long as regulation holds out the promise of improving safety. As elaborated below, this results in decisionmaking dynamics, both public and private, unlike
those attributed to other agencies charged with regulating health and safety.
Fire Extinguishers, Smoke Detectors, and the FAA
The FAA has an expansive regulatory mandate—to certify the air-worthiness of new aircraft, to control the nationwide air traffic control system, to regulate pilot certification, and to police airline operations and maintenance. The agency functions by leaving much to the discretionary judgment of the airlines and airframe manufacturers. Aviation technology is so complicated that the FAA realized years ago it did not have the resources or expertise to pass judgment independently on all new airframe designs. Instead, "designated engineering representatives," engineers employed by the airframe manufacturers, certify new airplanes for the agency. Matters of operation and maintenance are almost as complicated as aircraft design, involving highly technical systems and countless potential subjects for regulation. Airframe manufacturers employ hundreds of safety engineers and continually issue bulletins and warnings to their customers, the airlines. Airlines adopt their own safety routines and maintenance procedures as well. Confronted with the complexities of aviation safety, the FAA proceeds with a mixture of deference, prodding, and formal regulation. All three strategies are reflected in the evolution of the FAA's regulation of fire extinguishers and smoke detectors on commercial airlines.
Prodding takes the form of advisory circulars and general notices, both of which are "non-binding" but carry significant weight with the airlines. Smaller airlines with limited engineering capacity to develop their own standards are likely to adopt these recommendations. Larger carriers do their own evaluation, cognizant of the cost of ignoring government recommendations should something go wrong. Formal regulation usually follows from the most serious accidents and those that result in National Transportation Safety Board (NTSB) recommendations that have been made before. How these stages take shape depends on the seriousness of the accident and the nature of any prior experiences.
In the case of fire extinguishers and smoke detectors, the formal) standard was largely influenced by two tragic accidents: the Varig fire in 1973 and the Air Canada fire a decade later. Before these tragedies, however, the FAA long took a deferential approach toward fire extinguishers, mandating simply that "the type and quantity of extinguishing
agent must be suitable for the kinds of fires likely to occur in the compartment where the extinguisher is intended to be used." The airlines and airframe manufacturers were left to determine what was "suitable." The agency provided additional guidance with the advisory circular in 1965 that recommended up to three fire extinguishers per airplane and sanctioned the use of carbon dioxide extinguishers.  It contained no actual product specifications such as capacity, discharge time, or nozzle type. Nor did it speak to the placement of extinguishers or the training of personnel in their use.
Cabin fire safety attracted intense attention in 1973 when a terrible in-flight fire killed 124 people on a Varig Airlines Boeing 707 en route to Paris from Rio de Janiero. The fire, attributed to a discarded cigarette in a lavatory wastepaper disposal unit, broke out shortly before landing. Thick black smoke soon filled the cabin and cockpit. The pilots literally stuck their heads out the window in order to make a forced landing a few miles from the airport. Of the 135 people on board, only eleven survived; the remainder died of asphyxiation or from toxic gas. The NTSB focused on facilitating earlier detection and more effective suppression through smoke alarms and smoke masks for flight attendants respectively. The NTSB made numerous recommendations, including requirements for "a means of early detection of lavatory fires … such as smoke detectors or operating procedures for the frequent inspection of lavatories by cabin attendants." The FAA opted for more "No Smoking" signs, an appeal to the airlines for better monitoring by the crew, and a promise that the "FAA has begun a preregulatory study of the feasibility and justification for a requirement for smoke detectors in lavatories."
The advisory circular on fire extinguishers was completely out of date by the late 1970s, failing to take into account changes in airplane size and extinguishant technology. New jumbo jets with a seating capacity in excess of three hundred require many more extinguishers than the old planes. Virtually all airlines carried more extinguishers than suggested in the circular. Some also used the new Halon extinguishant, a liquid gas that extinguishes fire by chemically interrupting the combustion chain reaction (rather than by physically smothering it). Halon is a derivative of halgonated hydrocarbon. It is suitable for use in cold weather, leaves behind no chemical residue to contaminate or corrode aircraft parts, and can be three times more effective than carbon dioxide extinguishers of equal weight.
Boeing provided it on all new airplanes after 1979, but Halon still
was not mentioned in the FAA advisory circular until a series of "volatile liquid hijackings" raised concerns about the capability of current extinguishers. (The hijackers in these cases carried jars of gasoline, threatening to set the plane on fire.) The FAA's Office of Civil Aviation Security sponsored a study of hand-held fire extinguishers by the Factory Mutual Research Corporation. The FAA quickly revised the advisory circular on fire extinguishers to explain the advantages of Halon. The circular did not require Halon, however, and it provided no additional product specifications. The agency stepped up the pressure after tests at the FAA Technical Center revealed that Halon was better than carbon dioxide or dry chemicals at extinguishing volatile liquid fires. The agency's strategy, something between unsolicited advice and formal regulation, was to issue a general notice. G-NOTs, as they are known in the agency, are formal requests for "voluntary" compliance with a suggestion. They are the FAA's way of putting the airlines on the spot—requesting a specific safety improvement and requiring a formal response concerning the airlines' intentions. The agency accordingly issued a general notice on November 29, 1980, requesting all airlines to carry at least two Halon extinguishers.
About half of the carriers indicated that they had complied or would do so. A few expressed mild resentment at the FAA's refusal to take responsibility for the issue. If Halon was desirable, argued the vice president for engineering and quality control at Frontier Airlines, "there are regulatory means of requiring it rather than encouraging such devices be installed without providing sufficient justification." Several carriers worried about the possible toxic effects of Halon extinguishers. Some of this concern was prompted by warning labels. ("Use in an enclosed place may be fatal," warns the label on a Kidde hand-held Halon extinguisher.) But the evidence about the toxic effects of Halon in aviation use was limited and mixed. Boeing conducted live fire tests and endorsed the use of Halon, although the engineers refused to release their test data. American Airlines also conducted tests, and declined to use Halon because it left behind "a strong bromine smell that caused burning eyes and coughing."
The FAA relied on mild coercion until June 2, 1983, when an in-flight fire killed twenty-three people on an Air Canada flight near Cincinnati. The FAA was backed into a regulatory stance toward fire extinguishers and smoke detectors. As a rulemaking staff member put it, the agency gets "one free bite" in adopting regulatory strategies; that is, it has the most discretion in deciding how to address issues being raised
for the first time. But the FAA had already had one bite at these issues, The agency had tried gentle and coercive "advice" on fire extinguishers, and the NTSB had already recommended smoke detectors. New regulations would certainly follow. Their genesis is so clearly in the Air Canada disaster, however, that it is necessary to recount some details of that tragedy.
The Air Canada Fire
Stories from the survivors of the fire, which eventually killed twenty-three people, were sensational, frightening, and widely publicized. A fire broke out in the lavatory of the DC-9, and, as in the Varig fire, thick acrid smoke soon filled the plane. During its emergency descent to the Greater Cincinnati Airport, described by one passenger as "like an elevator ride," the pilot's chair was literally on fire. His vision was totally obscured by the time he landed the plane, tires exploding on impact. Flames burned through the roof of the fuselage, and scenes of firefighters combating the blaze with foam and water topped the national news.
The complete story, pieced together from separate reports by the National Transportation Safety Board and a special investigative unit of NFPA, is much less dramatic than the emergency landing and rescue effort. It all began with an electrical short in a lavatory pump. Three circuit breakers tripped in the cockpit, and a crew member tried without success to reset them. Eleven minutes later, a flight attendant detected smoke emanating from the lavatory. An attendant entered the lavatory, saw smoke coming from the wall liner, and discharged a carbon dioxide fire extinguisher in the general vicinity. Minutes later a second extinguisher was also discharged, and the smoke appeared to clear; but a flight attendant checking on the situation soon thereafter found the lavatory door so hot it was considered unsafe to open. The smoke reappeared and got worse. A master caution light in the cockpit signaled an electrical system failure. The pilot decided to make an emergency landing. It took ten minutes to land the plane. Visibility approached zero as the plane filled with smoke. Only those passengers who reached the emergency exits within about one minute of landing got out of the plane safely. The rest apparently succumbed to carbon monoxide poisoning.
Aviation accidents are almost never attributed to a single cause. Usually a combination of mechanical and human factors are involved.
With fires, the direct "cause" of any particular incident is obviously the ignition source. In that sense, a short circuit in the lavatory flushing pump caused the Air Canada fire. The consequences of ignition, however, depend on the combustibility of surrounding materials, the quality of fire detection and suppression, and various elements of the emergency response. Accordingly, the extensive damage from the Air Canada fire—the consequences of ignition—can be attributed to the delay before the crew detected and responded to the fire, the ineffective use of the fire extinguishers, the toxicity of the seat covers, and the difficulties encountered in evacuation.
Accident investigators tend to take an expansive approach when determining the "cause" of an accident. Aware that regulations are influenced by accident reports, investigators often seek to effect the greatest possible change. "It's better if you don't find the exact cause because then only one thing will get fixed," according to an NTSB investigator. Instead, for every serious accident the NTSB recommends a laundry list of changes in FAA regulations.
The Air Canada incident was no exception. Many culprits were identified. The NTSB was particularly critical of the crew for the delay between detecting the fire and deciding to land. A few independent experts consider this criticism unfair but concur that the crew was ineffective in its use of fire extinguishers. The NFPA report emphasized the problems of smoke and toxic gas, suggesting the need for more research on flammable materials, particularly seat covers. The NTSB wanted several things "fixed" as a result of the fire. It immediately recommended that the FAA inspect lavatory flushing pumps and establish a procedure for verifying whether the circuitry had been damaged over time. Three months later it recommended, among other things, the installation of smoke detectors and the use of Halon fire extinguishers.
Political Pressure and a Prompt Proposal
Every fatal airplane accident generates extensive media attention and strong political pressures. Congressional committees have an almost limitless inclination to investigate airplane accidents. In his study of policy analysis in the FAA, Steven Rhoads notes that "it would be difficult to overestimate the seriousness with which Congress views commercial air crashes." Within two months of the accident, three separate congressional committees held hearings on the Air Canada
fire. Accused of "footdragging" and indifference bordering on callousness, the FAA soon became Congress's scapegoat for the incident. Congressman Dan Burton (R-Ind.) made the exaggerated claim that "had [Halon extinguishers] been on-board Air Canada nobody would have died." Several congressmen introduced bills to mandate the NTSB's proposals on smoke detectors and Halon fire extinguishers. Congress was unlikely to regulate the matter by statute, however, since it had neither the inclination nor the resources to address such technical questions. (In any case, as one congressman put it, "I would not want to fly in a plane designed by Congressional committee.") Instead Congress strengthened the oversight process. One committee required the FAA to file monthly progress reports on the implementation of various NTSB recommendations. The pressure to adopt new regulations, including ones concerning fire extinguishers and smoke detectors, was intense.
The FAA knew it had to respond to the Air Canada fire with a regulation and was prepared to do so quickly. In short order the agency drew on its previous experience and drafted a simple standard. First, smoke detectors would be required in airplane lavatories and galleys. No effort was made to define the technical specifications for these devices. Second, a built-in fire extinguisher would be required in the towel disposal receptacle of each lavatory. (This had been suggested by the NTSB after both the Varig and Air Canada fires.) Finally, the number of fire extinguishers required would be increased, and at least two Halon 1211 extinguishers would be required on every plane. The choice of Halon 1211, and the exclusion of Halon 1301, was apparently based on the general notice sent out after the gasoline hijackings. The increase in the number of extinguishers required was simply an incremental guess. "We took a look at the wide bodies," a rulemaking staff member stated, "and said 'we need another extinguisher for every one hundred people.'" Otherwise, to a large extent, the NTSB essentially drafted the regulation.
Objections to the proposal were meek. The American Transport Association, which represents most major airlines and is considered by many to be a powerful lobbying organization, did not oppose "the basic thrust" of the proposal, only the requirement for smoke detectors in galley areas. The few other objections to the rule were technical. Some engineers argued that the standard should permit Halon 1301 as well as Halon 1211 (the numbers denote differences in chemical structure). Others alleged that household smoke detectors would not necessarily be reliable in airplanes. The effects of vibration were cited by Underwriters
Laboratories as one of several possibly significant aspects of aviation use that might impede performance. Unusual air currents might also be important, particularly in airplane lavatories, where the air moves down and out through the toilet bowl.
These claims might have been self-serving—UL was basically advocating that the FAA require laboratory certification of smoke detectors for aviation use—but they were also well founded. Devices designed specifically to endure the rigors of the aviation environment are far more sophisticated than a standard household detector. Detectors for airplane cargo holds, produced in accordance with an FAA Technical Standards Order, cost $800 to $1,300 each. When the Regulatory Analysis Division in the FAA first analyzed the proposed rule, they used cost estimates based on these devices and arrived at a benefit-cost ratio of less than one. The critical but unanswered question is to what extent accuracy and reliability are sacrificed by allowing the basic dime store model instead of the sophisticated aviation model. Household detectors are not particularly sturdy either. Given the rigors of aviation use, they might not work in time of need. (Liability concerns of this nature prompted at least one major manufacturer to decline an airline's recent order for 1,500 detectors.) Missing batteries, a problem noted by carriers that experimented with smoke detectors, could also incapacitate the smoke detector. Petty theft would not be the only motive. Sabotage by smokers breaking what is widely thought to be one of the most ignored FAA prohibitions—against smoking in the lavatory—is another possibility.
Another possible consequence, argued an official of the British Civil Aviation Authority, is false alarms, which would "soon give rise to a loss of faith in the detection system." Household detectors are sensitive to changes in air flows, something that occurs regularly in flight but seldom at home. Smoke is also common in galley areas, partly as a by-product of food preparation. Several airlines feared that the panic caused by an activated alarm might be worse than the possibility of a fire going undetected without a smoke detector.
Technical Objections and a Final Rule
The other technical objections to the proposed FAA standard concerned either the fire extinguishant or the nozzle configuration. Several manufacturers argued that Halon 1301 should be permitted in addition to
Halon 1211. Halon 1211 discharges in a more liquid state than Halon 1301 and has better range and direction in use. But Halon 1301 is considerably less toxic than 1211, so it may be advantageous in small areas such as the cockpit. The use of Halon 1301 in hand-held fire extinguishers is relatively recent. There were no hand-held Halon 1301 extinguishers when the FAA issued its general notice in 1980. Three years later, Metalcraft, Inc., received Factory Mutual Research Corporation's first approval for such a product. UL still did not list any. So there was limited information about the merits of this technical question.
The FAA balked and refused to consider the Halon 1301 alternative because, according to an FAA rulemaking staff member, "1301 is not rated for a Class A fire." The reference is to the UL method for rating fire extinguishers by type of fire and extinguisher capacity. But the reasoning is flawed because UL's Class A fire is simply too big. "Halon is effective on an 'A' fire," notes a fire protection engineer, "but the smallest 'A' fire [that UL builds] takes about nine pounds of agent." Hand-held extinguishers usually have three to five pounds. There may be technical reasons for restricting the use of Halon 1301, particularly in large cabin spaces, where it might be less effective than Halon 1211, but the reason offered by the FAA indicates no understanding of these issues.
A few commenters suggested that the FAA require flexible discharge hoses on all fire extinguishers. This would be particularly helpful in battling fires in concealed spaces, overhead, or under the seats. Fixed nozzles, which are supposed to be operated in an upright position, are difficult to operate under such circumstances. Tests conducted by one airline suggested that flexible nozzles increased effectiveness by an incredible magnitude of ten. The FAA showed little interest in this issue. The rule was published in final form less than four months after the comment period closed. There was only one significant change: smoke detectors would not be required in the galley. This eliminated the airlines' strongest objection without compromising on anything the staff considered critical. The safety record with galley fires was far more reassuring than the record for lavatories. There has never been a catastrophic in-flight fire, domestic or foreign, that originated in the galley. While this requirement was easily dropped, addressing the other objections raised in the comment period was not so easy. They called for changes in specific requirements and would require additional analysis. The FAA had no patience for these arguments. The agency wanted to placate Congress and get the rule published. The rulemaking staff had
no intention of letting public comments delay the process. The candid explanation of a staff member about comments concerning the value of requiring a flexible hose on Halon extinguishers illustrates the attitude: "There probably is a lot of benefit in a flexible hose. But we have a certain practical limitation here: we can't just go ahead in the middle of a rule action and change our minds and say that when the rule comes out we want twenty-five hundred airplanes to be equipped with flexible hoses. That throws everything into a cocked hat…. We had to make a decision and we made it." The rule was finalized in record time. It was promulgated on March 29, 1985, less than ten months after it was first proposed. Three years later, the FAA banned smoking on all domestic flights of under two hours. This may be the most cost-effective move the FAA could take toward reducing the risk of a cabin fire. The ban was adopted for health reasons, however, not for reasons of fire safety.
Evaluating the FAA Standard
Whether the FAA's new regulation would have prevented the Air Canada disaster or, more important, another catastrophe in the future is difficult to determine, partly because serious accidents are so rare. There were no deaths on U.S. commercial aircraft in 1980, for example, and only four in both 1981 and 1984. Even 1985, considered by many "the worst year ever" for aviation safety, was remarkably safe by comparison to other modes of transportation (particularly if deaths due to terrorist acts are subtracted from the total). Accidents are so rare, according to an actuary Metropolitan Life, that "it is almost pure chance as to which [major commercial airline] has a total loss" in any given year. The chances of a serious in-flight fire are even more remote. Most aviation injuries and fatalities are caused by impact, not fire. As an airline safety engineer put it, the fatal in-flight fire is "a rare animal of a rare breed." The first recorded fatalities from an in-flight cabin fire in the United States were in the Air Canada calamity.
The almost random nature of accidents creates the first paradox of developing (or analyzing) aviation safety regulations. Accidents precipitate strong political pressures for regulatory change, but they provide little factual basis for making meaningful improvements. Preventing random events is practically an impossible task. Instead of trying to anticipate the unknown, attention tends to get focused on preventing any repetition of what has already happened, regardless of the likelihood that it will happen again.
The politics of aviation safety also conflict with broader political trends concerning government regulation. Many members of Congress openly challenge the notion that aviation safety regulations should be undertaken only if benefits are at least commensurate with costs. Testifying before a House committee about several recent proposals for upgrading cabin safety, the chairman of the NTSB said he "would hate to see [their] implementation delayed for a cost-benefit analysis." Nevertheless, the FAA is bound by the same executive orders that require all agencies to conduct an economic analysis of proposed regulations.
This raises the second dilemma of aviation regulation: the FAA must justify in economic terms regulations that sometimes can only be justified on other grounds. This is not to say that the FAA's Regulatory Analysis Group engages in trickery or deception. The agency has refined the use of economic analysis over the years through its capital improvement projects for airport facilities. A detailed FAA manual spells out the procedures and many specific values (including the always controversial value of a life) to use in cost-benefit analysis. This simplifies and standardizes the agency's analysis. Nevertheless, this case demonstrates how the use of favorable assumptions can make a regulation of questionable economic benefit look economically desirable.
The FAA's Regulatory Analysis Group wrote a forty-three-page cost-benefit analysis of the proposal for smoke detectors and fire extinguishers. The analysis is systematic, comprehensive, and prominently featured in the Federal Register notice. The bottom line, according to the analysis, is that "total expected benefits equal $42.8 million and total costs equal $13.8 million, resulting in total expected benefit-cost ratio of 3.1 and a total expected net benefit of $29.0 million." There is much to take issue with in this analysis. For example, smoke detectors, assumed to cost $50 each, will very likely cost much more if airlines choose even a few of the features justified by the aviation environment (for example, tamper-proof battery packs, better vibration tolerance).
More important, there are several reasons to call into question not only the magnitude of estimated benefits but whether they actually exceed expected costs. One problem concerns predicting catastrophic in-flight fires. Recognizing the difficulty in predicting the distribution of essentially random numbers, the FAA staff utilized an elegant statistical solution: the Poisson distribution. The elegance of the solution masks the significance of one critical underlying assumption: the "expected mean value" of two catastrophic cabin fires in the next ten years. This
figure is purportedly based on "historical data." The Varig fire occurred in July 1973 and the Air Canada fire in June 1983. But the Varig fire was neither on a domestic carrier nor a domestic accident. The Air Canada fire caused the first fatalities in the United States from an in-flight cabin fire. To expect two similar fires every ten years seems overly gloomy, especially since there have been improvements in aviation fire safety since the Varig incident. After that fire, several airlines installed heat-sensitive fire extinguishers in trash receptacles. Moreover, there is nothing magic about a ten-year period. Thomas Hopkins, an economist at the University of Maryland's School of Public Affairs, notes in connection with the FAA's analysis of Floor Proximity Emergency Lighting—another proposal linked to the Air Canada fire—that "if the past five years are considered more representative of what lies ahead, there were no pertinent fatalities and so no plausible benefits." One problem with the agency's cost-benefit analysis, then, is that it does not test the sensitivity of this important assumption. Assuming a mean of one catastrophic fire (instead of two) every ten years could cut the potential benefits of the rule in half.
Other assumptions of vital importance to the analysis include the estimated "coefficients of effectiveness" for smoke detectors and fire extinguishers. Here the analysis purports to incorporate "conservative" estimates. These estimates are not as unambiguously "conservative" as the FAA staff suggests. One assumption is that a smoke detector could avert 50 percent of catastrophic lavatory fires. The staff provides no basis for this estimate or for labeling it "conservative." Stated another way, the coefficient is based on two assumptions: first, that in 50 percent of the lavatory fires that become catastrophic, quicker detection would prevent the catastrophe; and second, that off-the-shelf smoke detectors would actually provide quicker detection. Both assumptions are doubtful. Speed of detection certainly was not the problem in the Air Canada fire. The short-circuit alarm probably alerted the pilots faster than a smoke alarm would have. Delays and uncertainty in responding to the alarm—something as likely to occur with smoke detectors as with circuit breakers—were the main problems. Second, the detection capability of household smoke detectors in an aviation environment, as already mentioned, is quite uncertain. False alarms are likely to be a problem; some fires may go undetected. Combining these considerations, it appears that 25 percent, or maybe even 10 percent, is as reasonable an estimate as 50 percent. Similar arguments apply to the coefficients used for calculating the benefits of trash receptacle extinguishers.
A third problem with the economic analysis is that it overstates the benefits by failing to take into account existing "compliance" with the proposed rule. At least half of the commercial carriers voluntarily complied with the FAA's 1980 request to carry Halon extinguishers (a few even installed smoke detectors without any FAA advice). The benefits attributable to the proposed rule should reflect only the incremental benefit of adding Halon extinguishers to the remaining carriers. Instead, the FAA adjusted the cost figure to reflect the marginal cost of Halon extinguishers but not the marginal benefits.
The cost-benefit analysis also did not take into account the special training necessary to use a Halon extinguisher effectively. This means either overstated benefits or understated costs, depending on whether the airlines voluntarily improve existing training programs. Most airline employees receive cursory instruction in fire fighting. Only two airlines provide actual "hands on" training with fire extinguishers. "Hands on" training is particularly important with Halon extinguishers, which discharge in a liquid stream that must be carefully applied because it lasts less than ten seconds. Those not properly trained in the use of these sophisticated extinguishers may actually be less effective than with other extinguishers. Even with less-sophisticated extinguishers, untrained operators are generally able to extinguish only about half as big a fire as those with training. The carbon dioxide extinguishers aboard the Air Canada jet were discharged without effect in the early stage of that disaster. As an engineer with Factory Mutual Research Corporation put it, "It wouldn't have made any difference if you had given them another thirty extinguishers." The cost-benefit analysis never considered this issue. In fact, the provision for Halon extinguishers was given only superficial treatment. The staff considered these extinguishers "clearly cost-beneficial" because they are lighter than older extinguishers, so "fuel savings alone are expected to pay for this proposal." In short, they were assumed to be more effective. The projected $2.9 million in "pure safety benefit" might be more than outweighed, however, by the cost of training flight attendants adequately to ensure effective use.
Finally, even if the FAA were predisposed to write its own standard, the rulemaking staff should have been aware that the private standard NFPA 408 existed. At least one FAA employee has been on the NFPA's Aircraft Rescue and Firefighting Committee, charged with standards for aviation fire extinguishers, since NFPA 408 was first adopted in 1956. Two FAA representatives were on the committee when the standard
was revised in 1980 and later when the FAA decided to draft and adopt its own standard. One reason the rulemaking staff was unaware of NFPA 408 is organizational. Neither of the FAA employees were from the Airworthiness Division—the division that wrote the FAA's standard for fire extinguishers—and neither took a particular interest in NFPA 408. They were more interested in other aircraft rescue and firefighting standards. Beyond these peculiar circumstances, however, the fact that the rulemaking staff did not think to check for the existence of an NFPA standard is evidence of the low profile that currently characterizes these standards.
None of these issues was raised by those commenting on the proposed rule or, surprisingly, by the Office of Management and Budget in its review of the cost-benefit analysis. Politics, it seems, loomed larger than economics. "This was a motherhood issue," explains an FAA rulemaking staff member. "Who is going to argue about fire extinguishers in airplanes?" Indeed, the FAA received hundreds of handwritten letters and postcards from individual citizens in favor of the proposed rule.
A Little-known and Surprisingly Strict Private Standard: NFPA 408
One of the comments the FAA never formally responded to was a suggestion that the agency adopt a private standard for hand-held aircraft fire extinguishers, NFPA 408. That the FAA did not do so is not surprising—government regulators often look on private standards with disfavor. What seems unusual is that the FAA (at least the staff member in charge of drafting the standard on fire extinguishers) was unaware of the existence of NFPA 408 until the agency received the suggestion (which, incidentally, came from NFPA). Ignorance in this instance was a function of poor communication within the FAA and, more broadly, of the waning influence of private, industrywide aviation safety standards.
As with several other areas of regulation, aviation safety used to be addressed entirely by the private sector. When NFPA first got involved in the subject, government regulation was minimal, and the future of private aviation regulation looked promising. Responding to requests from the National Aircraft Underwriters' Association, UL formed an Aviation Department in 1920, and two years later it started offering a service that the FAA would later take over: certifying the airworthiness of aircraft. Insurance groups, interested in standards to use in making
underwriting decisions, asked the NFPA to develop various aviation standards.
NFPA is a membership organization similar to the American Society for Testing and Materials. "Volunteer" committees write the 260 NFPA codes and standards, and the membership at large votes on various standards at semiannual meetings. NFPA has over thirty-two thousand members, including architects, engineers, firemen, and representatives of manufacturers, insurance interests, labor, and government.
One of the standards NFPA developed in the aviation area was NFPA 408, which contained recommendations concerning the "type, capacity, location and quantity of aircraft hand fire extinguishers and accessory equipment provided essentially for the protection of aircraft compartments occupied by passengers and crew. It was drafted between 1947 and 1955 by a technical subcommittee of NFPA's Aircraft Rescue and Firefighting Committee. The group had twenty-four members, including seven from government agencies in the United States and Canada, six from commercial airlines, two from academia, and one each from UL and UL of Canada. NFPA 408, with appendices, was less than six pages long. It provided information on the two most prevalent types of extinguishers (dry chemical and water) and mandated that airlines carry one small extinguisher in the cockpit and, depending on occupancy, between one and three in the passenger compartment. The standard also set forth a suggested training outline on the use of fire extinguishers. Unfortunately, NFPA has no record of how these specific provisions were developed. (Only in recent years have comments and committee minutes routinely been retained.)
Over time, interest in private, industrywide aviation safety standards diminished—at least in this country. The Civil Aeronautics Board, predecessor to the FAA, displaced UL's entire Aviation Department. Insurers began using compliance with the FAA's airworthiness standards as a condition of insurance. As technology became more complicated, airframe manufacturers (for example, Boeing, Lockheed, McDonnell-Douglas) assumed much of the responsibility earlier undertaken by commercial carriers. Currently, "most carriers will accept what the airframe manufacturer offers," according to the fire protection engineer at the only major airline to employ one.
This apathy affected NFPA 408. Although reissued in 1965, 1970, and 1973, the standard was largely unchanged from its original version. The main reason, suspects a current member of the Aircraft Rescue and Firefighting Committee, is expressed by the adage about letting sleeping
dogs lie: "There had never been a demonstrated problem warranting attention." There also was little interest in such standards among domestic airlines and airframe manufacturers. The in-house standards at Boeing were more important than NFPA 408. The primary interest in NFPA 408, and in many of NFPA's other aviation safety standards, was from foreign countries. As one committee member put it, "There is no FAA in Greece." Many foreign governments thus look to these standards for guidance. But the foreign contingent on the committee did not attend meetings regularly, and many lacked sufficient technical background to suggest improvements. Moreover, given the limited demand for the standard, NFPA 408 generated almost no income for NFPA. (The sale of publications accounts for two-thirds of NFPA's income.) But NFPA 408 is one of many NFPA standards offered more as a public service than as a money-making proposition, and at times these standards suffer from lack of attention.
NFPA 408 languished in the late 1970s when changes in technology rendered it out of date (it did not take into account the new jumbo jets, which could hold over three hundred passengers). The relevant provision in the 1973 version (for occupancies "over 61 passengers") called for three fire extinguishers. "An airframe manufacturer would never provide so few extinguishers [for a jumbo jet]," notes an NFPA committee member. Halgonated extinguishing agents also came into use in the 1970s, but NFPA 408 made only a passing reference to them. The 1973 version still allowed carbon dioxide extinguishers, which had long since fallen out of favor with most fire protection engineers because of the damage they can do to electrical equipment.
The 1980 Revival of NFPA 408
The Standards Council, the general oversight group within NFPA, recognized the problem in 1980, when nine aviation safety standards, including NFPA 408, were overdue for revision and reissue. The chairman of the Technical Committee on Aircraft Rescue and Firefighting considered 408 so inadequate that he proposed that NFPA withdraw it and start over from scratch. Withdrawing the standard as outdated was not in the interest of the Standards Council, however, which seeks to protect NFPA's reputation and is aware that the organization obtains its income largely from the sale of standards. Even though the income from this standard is minimal, it is in NFPA's general interest to keep its standards available. The Standards Council instructed the committee to
expedite the process of bringing the standard up to date. A technical subcommittee met several times in the following year and drafted a new version. The new standard included changes in the number of extinguishers required, the type of extinguishers, and the nature of employee training. All of these changes were in the direction of being more stringent, although a few were left as suggestions rather than stated as requirements. Most significant, however, the basic requirements of NFPA 408 were more demanding than what the FAA eventually required.
The most significant and costly provision in NFPA 408 specifies the number of extinguishers required. The revised version requires more than twice the number specified in the old version—and more if necessary, to ensure that there is an extinguisher within thirty feet of any passenger. How did the subcommittee choose these numbers? By doing for aviation safety what the 61B committee would not do for grain elevator safety: a combination of guesswork and fire protection rules of thumb. "If you are asking whether it is like Newton's law, where we can categorically support the conclusion, the answer is no," explained an engineer on the committee. There was surprisingly little disagreement among committee members, however, concerning the specific numbers chosen. Most members, even those representing the airlines, took the general view that the standard should err on the side of safety. In this respect, NFPA 408 reflects the professional norms of aviation safety engineers, who frequently rely on significant margins of safety. The margin of safety in the revised version is more than adequate. This standard is unlikely to produce benefits in excess of costs, however. A candid NFPA staff member admitted that this is probably true of all NFPA aviation safety standards.
The revised version of NFPA 408 also takes into account recent changes in extinguishant technology. The standard prohibits carbon dioxide extinguishers. (The FAA still allows them.) NFPA 408 also specifically requires, for the first time, the use of Halon 1211 extinguishers. Several key committee members knew that Halon 1211 is an extremely effective extinguishant. The toxicity question, raised by several airlines in response to the FAA's general notice, was not a sticking point. Most members consider these concerns exaggerated and inappropriate. "You have to put out the fire before you start worrying about toxicity," explained one member. There was minor disagreement about which Halon agent to require, but the idea of Halon was endorsed largely on the recommendation of the committee's engineers. Represen-
tatives of companies that manufacture such extinguishers naturally supported the idea as well, but those firms make all types of extinguishers and have no particular stake in Halon.
Flexible Nozzles and Special Training
The Technical Committee on Aircraft Rescue and Firefighting considered two other issues to be important—flexible nozzles for extinguishers and special training for the use of Halon—but they acted in a markedly less decisive manner on both. On flexible nozzles, the fire protection engineer from a major airline made a convincing case that extinguishers would be much more effective with this design change. He conducted tests that indicated that models with a flexible hose could be almost ten times more effective than current models in aviation use. The committee was largely unmoved, however, and simply changed the standard to permit flexible hoses but not require them. An appendix section advises that "for access to underseat, overhead, and other difficult to reach locations consideration should be given to using extinguishers with a discharge hose."
This seemingly timid approach is a product of the tangled web between installation standards (such as NFPA 408) and product standards (such as UL's). NFPA does not write product standards per se. It does, however, specify some performance characteristics for products. This creates an awkward relationship with the product standards written by such organizations as UL. Sometimes performance characteristics are closely linked to basic product specifications. For example, requiring high enough temperature tolerances for a chimney necessitates that it be made of metal, not masonry. In some instances, NFPA's requirements seem to drive UL's standards; in others, the UL standard appears to control the NFPA standard. The situation is often compared to the proverbial chicken-and-egg problem. In the case of fire extinguishers, however, it is clear which came first: UL did.
Realistically, NFPA can require something different from UL only when it is sure that UL will change accordingly. This is practically assured when the NFPA standard affects a substantial share of the certification market. But in the case of aircraft fire extinguishers, the NFPA standard affects a minuscule portion of the market regulated by UL. Not only does UL feel little pressure to change its fire extinguisher standard to satisfy the special concerns of aviation use; it foresees a
limited reward for the effort as well. The market for aviation fire extinguishers is too small.
The generic UL standard for fire extinguishers continues to take precedence over any NFPA requirements in 408. UL tests extinguishers under specific conditions and certifies them with different ratings. NFPA 408 depends on these standards to define the capabilities of the fire extinguishers required by NFPA standards. What UL requires is not necessarily what NFPA would choose for aviation use. UL does not require a flexible hose on small hand-held extinguishers, for example. Nor does it require a discharge time of more than eight seconds for the typical small Halon extinguisher. A United Airlines engineer thinks that twelve to fourteen seconds would be much more desirable. And flexible nozzles are clearly a major improvement over fixed nozzles for aviation use.
The other technical issue considered, but skirted, by NFPA involved the training requirements for using Halon extinguishers. The committee settled on a vague requirement that "training shall provide classroom instruction and manipulative skills training." The appendix removes the teeth from this provision, however, by adding that "it is highly recommended that live fire training on representative aircraft fires be conducted … [but this is] not required by this standard."
The mild-mannered approach to this provision also stands in contrast to the other more stringent provisions of 408. It reflects in part NFPA's reluctance to specify training requirements and in part the resistance of the airlines to a significant and recurring expense. The representative of Factory Mutual, who had recently conducted a study of hand-held fire extinguishers under contract to the FAA, recalls that the importance of training costs was repeatedly mentioned by those he surveyed. Fire safety experts agreed that training in realistic test situations would be costly. NFPA has a general position against addressing training or other seemingly managerial tasks. The Aircraft Rescue and Firefighting Committee managed to include more specific statements about the nature of recommended training procedures than are contained in most NFPA standards. But even that language is weak.
The committee members approved the proposed changes in May 1983, a full year before the FAA proposed its own rule. A public comment period followed release of the document to the NFPA membership, and when the committee met the following November it was faced with a total of fourteen comments from only four individuals. UL submitted the most detailed comments, most of them definitional, demon-
strating a better understanding of fire extinguishers than the committee as a whole. There was a minor spat about whether a competing Halon agent—lower in toxicity, but also less effective—should be permitted. The committee rejected those proposals on the grounds that they were not supported by accompanying technical data. NFPA 408 was approved without comment or question by the general membership at the organization's 1984 annual meeting. It became effective on July 5, 1984, a little more than two years after the Standards Council instructed the committee to expedite the revision process.
Deciding whether either the FAA or the NFPA standard is desirable depends on the choice one makes between the economic and political views of aviation safety. In economic terms, it is unlikely that either standard produces benefits in excess of costs. Aviation safety experts in both sectors confirm that almost no recent proposals for improved aviation safety can be justified on economic grounds. This does not render these standards unpopular, however. The political culture of aviation safety is characterized by an extreme "no-risk" perspective that apparently cuts across public and private boundaries. Congressman Norman Mineta (D-Calif.) recently allowed that "no rational risk analysis or cost-benefit analysis would conclude that the next increment of safety improvements needed in this country is in aviation." He went on to argue for precisely such expenditures. A similar view prevails at NFPA. Apparently, all that matters in either sector is whether new regulations might make the skies safer—how much safer and at what cost are of little interest.
"Safe enough," notes an NTSB official, sounding a popular chord, "means safer every year." In those terms, both the FAA and NFPA standards are probably desirable. That is, they would contribute, however minimally, to improvements in aviation safety. But even that conclusion is unsure, particularly for the FAA standard. One aviation safety expert considers the FAA's response to the Air Canada fire purely "cosmetic." While virtually everyone connected with the smoke detector business had serious doubts about putting household detectors in airplane lavatories, the FAA was unconcerned. A rulemaking staff member demurred that the UL standard for household detectors "is a very impressive document," implying that it provides sufficient requirements for aviation use. UL disagreed, detailing in a letter to the FAA's public docket numerous reasons why household detectors are inappropriate
for aviation use. The height of FAA hubris is summed up in a staff member's conclusion that, although there might be operational difficulties, "we say in the rule that [the airlines] are expected to keep [the smoke detectors] working."
A lack of technical understanding, similar to that expressed by OSHA in the grain elevator proceedings, was evident in how the FAA dealt with fire extinguishers. The rulemaking staff did not appreciate the possible significance of flexible nozzles. Nor did they apparently understand the need for special training in the use of Halon extinguishers. These points were called to the FAA's attention, however, and the failure of the agency to respond demonstrates the extent to which FAA rulemaking is driven by political pressures. After the Air Canada fire, the FAA was painfully aware that Congress wanted the agency to enact a rule, any rule. And that is precisely what the FAA did—placate an impatient Congress with a quick, but half-baked, safety standard.
In sum, the FAA displayed a surprising range of regulatory behavior over time. The agency relied on quiet advice for years, deferring largely to private decisions. That tactic is more effective than it is often portrayed. The airframe manufacturers probably do more to advance aviation safety than the FAA does. But the FAA is quick to regulate when it is subject to strong congressional pressure, usually triggered by the NTSB recommendations that follow every calamity. The FAA's response to the Air Canada fire demonstrates that public standards-setting need not get bogged down in procedural requirements. This encouraging note is tempered, however, by the realization that important technical issues were overlooked in the rush to regulate.
The private sector, on the other hand, was slower and more sensitive to technical issues. Expressing the kind of technical knowledge also present in the grain elevator proceedings, the NFPA committee recognized the benefits of flexible nozzles and proper training. Showing the same regulatory philosophy present in the grain elevator proceedings, the committee declined to adopt specific requirements in areas deemed "managerial." The committee made "non-binding" recommendations instead. But the NFPA standard is actually more demanding than the FAA's in its requirements for fire extinguishers. That is probably because professional fire safety engineers played a central role in the development of NFPA 408. These engineers do not profess to balance costs and benefits in the pursuit of fire safety. Rather, there is a powerful professional tendency, even in the private sector, to "favor fire protection for the sake of fire protection."
The NFPA standard does not address smoke detectors; they are not within the formal jurisdiction of the Aircraft Rescue and Firefighting Committee. While this lapse is not necessarily bad, it suggests a possible shortcoming of private standards-setting. The specialization of committees threatens to overlook broader regulatory issues and ignore some of the connections between standards. To address these problems, there is a proposal within NFPA to create a "Cabin Fire Protection" committee. An active participant in NFPA 408 calls the proposal controversial and political. "It would require much broader expertise than anyone has. But everyone would want to be on that committee."
The tangled connection between so-called installation standards (such as NFPA 408) and product standards (such as UL's standards for fire extinguishers) also affected the quality of NFPA 408. The standard relies on UL's generic standards for fire extinguishers. But the UL standard is not geared to the aviation environment. Technological changes that would be appropriate to aviation standards—such as flexible nozzles, longer discharge time, or a Class A rating for five-pound extinguishers—are therefore not incorporated into NFPA 408. Unfortunately, the cause and possible cure of this disjuncture between installation standards and product standards is not clear from this case alone. This chicken-and-egg problem confounds various cases of overlapping private regulation.
There was also a marked change in private behavior over time, but for reasons unrelated to the Air Canada fire. NFPA 408 languished in the 1970s, when, as an NFPA officer quaintly explains, there was "an attendance problem." The Standards Council intervened in 1980, and the standard was revitalized shortly before the Air Canada fire in 1983. The changing fortunes of NFPA 408 reflect the importance of the demand for private standards. Standards are demanded for a host of reasons: for example, to provide technical information, to lend credibility, and to minimize exposure to liability. The first two of these influences waned as airframe manufacturers seized the initiative for most safety issues. These manufacturers obviously have the technical capability, and they apparently have attained the political credibility to engage effectively in self-regulation. (Liability law does not appear to be an important influence in aviation standards, since the law assesses liability practically without regard to fault.) As the demand for NFPA 408 waned, so did attendance at the Rescue and Firefighting Committee. Some foreign air carriers still sought regulatory information, but the domestic demand was minimal. The correspondingly low revenue gen-
erated by this standard probably helps explain NFPA's acquiescence in this lapse. The evolution of NFPA 408 suggests that minimal demand can beget minimal standards. Attempting to reverse this trend, the NFPA Standards Council pushed its aviation committees to update their standards in 1980. This restored the standard to the substantive status it had enjoyed before falling into disuse. But the demand is artificial. There is no evidence that air carriers or airframe manufacturers actually use this standard. It seems likely, therefore, that it will languish again, NFPA's gallant efforts to sell more standards notwithstanding.