On July 17, 1996 at 2031 EDT, TWA Flight 800, a Boeing model 747-131, registration number N93119, crashed into the Atlantic Ocean about eight miles south of East Moriches, New York, after taking off from John F. Kennedy International Airport. The airplane was being operated on an instrument flight rules (IFR) flight plan under the provisions of Title 14, Code of Federal Regulation (CFR), Part 121, on a regularly scheduled flight to Charles De Gaulle International Airport (CDG), Paris, France.

The airplane was manufactured in November 1971 and had accumulated about 93,303 flight hours and 16,869 cycles. On board the airplane were 212 passengers and 18 crewmembers. The airplane was completely destroyed, and all 230 passengers and crew members on board were killed.

The crash was the result of a sudden and catastrophic in-flight breakup. Witnesses saw an explosion and then debris descending to the ocean. The flight crew did not report a problem to air traffic control. There was no weather or other external factors that influenced the breakup.

Several early eyewitness accounts also reported having seen a missile, or missile contrail, in the vicinity of the airplane at the time of the explosion. This prompted early speculation that the accident may have been the result of an act of terrorism. Because of these early claims, it was believed prudent to approach the investigation both as a potential crime scene, as well as an accident scene. The investigation of TWA Flight 800 was unprecedented in that, as a result of the dual initial focus, both the Federal Bureau of Investigation (FBI) and the National Transportation Safety Board (NTSB) co-led the investigation. This required both a crime scene "chain-of-custody" process to be applied for all wreckage as well as "normal" aircraft accident recovery cataloguing processes. Recovered parts were thoroughly examined for evidence of bomb/missile debris fragments, explosive residue, or any other evidence of a hostile act. None were found.

Three debris fields were identified based on distribution of wreckage on the ocean floor. The general debris fields were noted as depicted in the graphics to the right.

These animations and diagrams were created by the NTSB to illustrate airplane breakup and debris fields.

View an animation reconstructing the final flight path of this aircraft below:

The NTSB determined the cause of the accident was an explosion of the center wing fuel tank, resulting from ignition of the flammable fuel/air vapors in the tank. The source of ignition energy could not be determined with certainty. Of the ignition sources evaluated by the investigation, the most likely scenario was a combination of a latent fault of an electronic fuel quantity indicating system component within the fuel tank, combined with a short circuit or other fault outside of the tank. This scenario would result in a high-energy electrical arc within the fuel tank that could ignite the flammable vapors.

Flammable Fuel Tank

The 747-100 contains seven fuel tanks. The explosion which initiated the breakup was believed to have originated in the center wing tank (CWT). The following diagrams illustrate the 747-100 fuel tanks.

For structural reasons, wing tanks are filled first, and then any remaining fuel needed for a particular flight is put into the CWT. The volume of the 747-131's CWT, by all standards, is large. It has a Jet A fuel capacity of 86,363 pounds (12,890 gallons). Based on the length of TWA's flight to Paris, fuel in the center wing tank was not required. As with all transport airplanes, even this "empty" tank still contains a small amount of unusable fuel, estimated at around 50 gallons, and resides in small "pockets" and trapped areas on the lower tank surface.

The investigation established that prior to departure the airplane had been exposed to high ambient temperatures at JFK. Two air conditioning (AC) packs (1 and 3) had been running for about 2 ½ hours prior to the flight. The combination of high ambient airport temperatures and operation of the AC packs, which are located below the center wing tanks, influenced the resultant temperatures within the tank. An "unintended" effect of the proximity of air conditioning packs and the center wing tank was that the air conditioning packs transferred heat into the fuel tank. The majority of transport airplanes in service today have a similar arrangement of center tank and air conditioning equipment, and undergo similar effects.

Based on a NTSB-sponsored flight emulation of TWA 800 using a 747-121 (documented in the NTSB report), the highest ullage temperature measured within the CWT was 145 degrees F, which occurred just before the airplane began to taxi for takeoff. These high temperatures had the result of increasing evaporation of the small amount of fuel at the bottom of the tank, and thus increasing the flammability of the resulting fuel vapor/air mixture in the empty center tank.

All seven fuel tanks on the 747-100, including the center wing tank, are vented to ambient atmospheric pressure, so after the flight took off and gained altitude, the pressure within the fuel tanks began to drop. Because the center wing tank has minimal ability to reject heat, the internal temperature drops slowly as the flight progresses. Based on the previously mentioned NTSB-sponsored emulation flight, the CWT temperatures at 13,700 feet (at the time of the TWA 800 explosion) were estimated to range from 103 to 127 degrees F.

The following animation illustrates the flammability characteristics of Jet A fuel and the ullage space vapors for the center wing and main wing tanks of a 747-100.

View TWA 800 Flammability Envelope Animation below:

During the course of the investigation, the relationship between the fuel tank ullage space temperature and the energy level required for vapor ignition became a key factor in determining the flammability of the center wing tank. It was learned that the center wing tank vapor temperatures, at the altitude and temperature conditions of the flight at the time of the tank explosion, were optimal for ignition, and therefore minimal ignition energy levels were required for a tank explosion to occur. As a result, the number of potential ignition sources, rather than being ruled out by the level of energy required for an explosion, were expanded. High-energy failure events, such as fuel pump disintegration, as well as low-energy events, such as static discharge, all became candidate plausible sources from an ignition energy perspective.

Fuel Tank Safety Strategies

For large commercial transport airplanes such as the 747, the fuel tank safety strategy is predicated upon potential threats that can be identified in two basic categories:

1. Internal threats, such as wiring failures, pump failures, etc.


2. Environmental threats, such as lightning and, high-intensity radiated fields (HIRF) external to the fuel tank.

For protection against the known/assumed internal threats, the 747 and all other commercial transport airplanes incorporated as a design philosophy, ignition prevention within the fuel tank. This includes expected in-tank failure conditions, system malfunctions, and all adjacent sources that may influence tank temperature (bleed air duct failures, etc.). This design approach is generally referred to as "explosion proof" capability.

All components within the 747 were shown to be explosion proof during the course of their approval. For example, the FQIS probes were shown to withstand several thousand volts of electrical overload without resulting in a spark, or overheating. This was believed to provide a large margin of safety, since the operating voltage of the FQIS probes is just a few volts. Similarly, all pumps which communicate with the fuel tank were shown to withstand mechanical and electrical failures, such as locked rotor events, bearing failures, wire shorts, etc., without resulting in a hot surface or spark within the tank.

Further, it was assumed that since all fuel tank components were "explosion proof," in-tank FQIS components did not require periodic maintenance, and were left "on-condition" for the life of the airplane. On-condition is a maintenance term applicable to airplane systems or components which are not generally inspected or maintained on a prescribed schedule, but rather addresses only when a malfunction or failure occurs. It was assumed that the system would stop providing fuel quantity indication, or otherwise passively fail, before a hazardous ignition threat existed.

For environmental threats, such as lightning, the tank arrangement, structure, and components were shown to be free from hazardous sparks or temperatures from both the direct and indirect effects of a lightning strike. Following a lightning-caused fuel tank explosion accident involving a Pan American 707 near Elkton, Maryland in 1963, extensive research was conducted. This culminated in the issuance of regulations and policies related to lightning protection of transport airplanes.

During the course of the TWA 800 accident investigation, investigators inspected dozens of aircraft of various models, including the 747, and reviewed thousands of records related to fuel tank service problems. The product of these reviews identified numerous shortcomings in safety features related to explosion-proof integrity. These ranged from unexpected failure conditions (e.g., fuel quantity indicating system probe contamination), missing parts (e.g., pumps misassembled following overhaul), and other potential in-tank ignition sources.

Three general conclusions were drawn from this intensive review:

1. The 747-100 fuel system arrangement and components were similar to many other aircraft being produced and in service. For example, pumps, probes, wiring, and other features were common to those of other airplane models.
2. Numerous potential in-tank ignition sources were identified on the 747 and many other in-service airplane models.
3. Reliance only on ignition prevention as a safety strategy was not providing an acceptable level of safety.

TWA 800 Fuel Tank Ignition Source

The exact ignition source that ignited the flammable fuel vapors in the CWT of TWA Flight 800 was not able to be determined with certainty. However, following extensive review of recovered wreckage, available flight recorder information, and examination of many similar aircraft, the most likely scenario identified by the NTSB involved a combination of a latent fault in the fuel quantity indication system (FQIS) with an out-of-tank wiring fault.

The 747-131 FQIS utilizes a number of probes distributed throughout the fuel tank, as shown in this illustration. Wiring from these probes runs out of the tank and forward to the cockpit, where gauges interpret the signals and indicate the amount of fuel in each fuel tank.

The NTSB identified the most likely scenario as some type of latent fault with a fuel quantity sensor, combined with a subsequent active fault. The latency in this case, apparently did not affect normal operation of the sensor, however it may have produced a high-energy electrical arc when higher voltage was inadvertently introduced onto the wires that lead into the fuel tank and to the fuel quantity sensor. The NTSB report and subsequent analysis revealed several possibilities for a latent fault. One of the scenarios involves a certain type of corrosion/contamination involving sulfide deposits that can build up over time between the electrical contacts on the FQIS probes (sulfur is present in Jet A fuel). These deposits don't affect normal FQIS operation, but can create an arc if exposed to higher voltages.

The most likely scenario, cited by the NTSB for introducing a high-energy electrical source into the fuel tank, was a short circuit in a wire bundle outside the fuel tank, allowing high voltage (115 VAC) into the low voltage wires that run into the fuel tank.

View TWA 800 Ignition Source Animation below:

The high voltage introduced to the FQIS probe may have caused an electrical arc, which ignited the flammable fuel vapors. The resulting pressure spike began a series of cascading structural failures that culminated with the in-flight breakup of TWA Flight 800.

Accident Memorial

TWA Flight 800 International Memorial was created in 2002 in honor of the 230 passengers and crew that were killed on July 17, 1996. The memorial is located in Smith Point County Park, Long Island, New York, near the site of the accident.

Back to top

The NTSB issued 25 findings, primarily addressing the cause of the center wing tank explosion and tank flammability. The complete text of the findings is available at the following link: (NTSB Findings)

The NTSB identified the probable cause as:

"The National Transportation Safety Board determines that the probable cause of the TWA Flight 800 accident was an explosion of the center wing fuel tank (CWT), resulting from ignition of the flammable fuel/air mixture in the tank. The source of ignition energy for the explosion could not be determined with certainty, but of the sources evaluated by the investigation, the most likely was a short circuit outside of the CWT that allowed excessive voltage to enter it through electrical wiring associated with the fuel quantity indication system.

Contributing factors to the accident were the design and certification concept that fuel tank explosions could be prevented solely by precluding all ignition sources and the design and certification of the Boeing 747 with heat sources located beneath the CWT with no means to reduce the heat transferred into the CWT or to render the fuel vapor in the tank nonflammable."

To view the complete NTSB report for this accident, and its appendices, use the following links: (NTSB Report) (TWA 800 Appendices)

Back to top

The NTSB issued four new recommendations to the FAA in the official accident report. They further addressed 11 recommendations that had been issued during the accident investigation and reclassified five other recommendations. The complete text of these recommendations is available at the following link: (NTSB Recommendations)

Back to top

14 CFR 25.981 Fuel tank ignition prevention (Earlier Amendment, prior to TWA Flight 800 Accident. Note the focus was on temperatures within the tank.). The complete text of the rule is provided.

Sec. 25.981

Fuel tank temperature.

(a) The highest temperature allowing a safe margin below the lowest expected auto-ignition temperature of the fuel in the fuel tanks must be determined.

(b) No temperature at any place inside any fuel tank where fuel ignition is possible may exceed the temperature determined under paragraph (a) of this section. This must be shown under all probable operating, failure, and malfunction conditions of any component whose operation, failure, or malfunction could increase the temperature inside the tank.

Amdt. 25-11, Eff. 6/4/67

Back to top

Flammability Reduction

At the time of the TWA accident, there was a widely held industry position that a commercially viable fuel tank inerting system was beyond the current state of the art. An Aviation Rulemaking Advisory Committee (ARAC) study conducted in the late 1990's concluded that military aviation inerting systems showed promise, but were judged to be too heavy, complicated, unreliable, and costly for commercial applications. Further, the military systems in use targeted Oxygen concentration levels of less than 10%, which was difficult to achieve in a lightweight, reliable system, and was not cost effective to install, operate, or maintain. As a result, the industry did not view fuel tank inerting as a practical solution for fuel tank safety enhancements.

Ignition Prevention

At the time of development of the Boeing Model 747-100, and nearly all other transport airplanes of that era, through the late 1990's, it was generally believed that design practices were capable of completely eliminating in-tank ignition sources. This capability was dependent on several assumptions: 

• Wiring was viewed as "on-condition" and did not require targeted maintenance unless a specific problem was discovered.
• Circuit breakers were considered adequate to protect wiring from all failures.
• Wiring for multiple systems could be co-bundled without causing failures which could be catastrophic.

Post TWA 800 accident inspections of many in-service airplane models, extensive testing, and subsequent accidents led investigators to conclude that these assumptions were not valid.

Possibility of Terrorism

At the time of TWA 800 (1996), there was increased focus on terrorism and national security. Pan Am flight 103, December 21, 1988, an earlier accident, in Lockerbie, Scotland, was an inflight disintegration of a Boeing model 747, resulting from an onboard bomb. When the TWA 800 accident happened, terrorism was initially suspected, and dominated the accident investigation for more than 2 years. The initial investigation was supported by both the FBI and NTSB. The accident was simultaneously treated as both a crime scene and an accident scene. The FBI was looking at all wreckage as possible crime scene evidence, and the NTSB was looking at it from an accident investigation perspective. The NTSB report provides a thorough discussion of how terrorism was ruled out as a cause of the TWA 800 accident.

Back to top

High Flammability

• After extensive post-accident investigations, it was learned that the flammability of the center wing tank of the 747-100, and many other similarly configured tank installations, was much higher than originally believed. Consequently, the FAA has issued regulations which when applied, are intended to substantially lower the flammability exposure of these types of tank systems.

Ignition Sources

• Numerous ignition sources were identified during post-accident inspections of the 747-100, and other in-service airplanes. Consequently, numerous airworthiness directives were issued, and continue to be issued, which are intended to reduce the risk of in-tank ignition.

Back to top

• "Explosion proof" fuel tank design philosophy, focusing on the prevention of ignition sources. It was assumed that ignition sources within fuel tanks could be effectively prevented.

Back to top

May 11, 1990 - Philippine Airlines 737-300 center tank explosion - While the airplane was on the ground at Manila, Philippines. Flammable vapors in the center tank exploded while the airplane was being pushed back before flight. There were eight fatalities and 30 injuries. Although no evidence was found that positively identified the ignition source in the accident, as a precaution, prolonged fuel pump operation in an empty center wing tank was suspended for the Boeing model 737 fleet.

Back to top

Near Term Actions - Ignition Prevention

Efforts to resolve TWA 800 led the FAA to conclude that many current airplanes had shortcomings similar to the 747 in their ignition prevention approaches. Therefore, the FAA issued Special Federal Aviation Regulation (SFAR) 88 in 2001 which:

1. Required the reexamination of the existing commercial fleet related to ignition prevention, and;
2. Required the implementation of safety enhancements related to the findings of these examinations.
   For a review of SFAR 88 regulatory changes, and associated advisory material, see the following links: (SFAR 88 discussion) (AC 25.981-1C)

Long Term Action - Flammability Reduction

In the course of executing SFAR 88, many more potential ignition sources were discovered on many different airplane models. In addition, there were two more fuel tank explosion-related accidents, which underscored the difficulty in preventing all ignitions, and the urgency of applying a second layer of protection for fuel tank safety. As a result of finding these additional ignition sources, and the advances in the development of a practical inerting system, the FAA proposed rulemaking in November 2005 to require a means to reduce flammability be installed on certain aircraft which had been identified as having high flammability tanks, such as the 747-center wing tank that was involved in the TWA 800 accident.

Most of the fuel tank ullage spaces transport airplanes are vented to atmosphere, and as such, are composed of approximately 21% oxygen and 79% nitrogen at sea level. An effective method for reducing the risk of flammability has involved adding nitrogen-enriched air into the ullage space, thereby displacing some of the oxygen. Several military aviation applications involve this process, referred to as "inerting," and result in oxygen content below a level which can sustain combustion. Performance standards for military inerting applications have oxygen concentrations of 9% or less in order to be explosion proof from combat damage, such as incendiary rounds. However, subsequent testing conducted by the FAA established that oxygen concentrations of 12% provided adequate protection against ignition hazards likely to be found on commercial transport airplanes. This discovery provided an opportunity for more cost-effective inerting systems to be developed.

The following figure, a summary of several studies, establishes that concentrations of 12% provide adequate protection from tank overpressures.

Long Term Action - Continued Airworthiness and Safety Improvements for Transport Category Airplanes

TWA 800 Post-accident investigation discovered numerous deficiencies in wiring and wiring related components. The Boeing 747 and nearly all other transport airplanes examined during this investigation revealed wiring problems associated with aging and deterioration. As a result of these findings, the FAA issued a new rule, intended to address wiring as a specific system, with targeted maintenance. For further information on this initiative see 14 CFR part 26. This new rule and an accompanying change to 14 CFR part 25 was adopted on November 8, 2007, by means of Amendment 26-0 to 14 CFR part 26, and Amendment 25-123 to 14 CFR part 25.

Additional FAA research established that the air separation module (ASM), a key component of the inerting system, performed well at lower differential pressures. It was previously believed that ASM technology required much higher differential pressures, such as those being used in medical and agricultural applications. This understanding allowed ASMs to be integrated into turbine engine bleed air systems which typically operate at 10-40 psi, rather than the "normal" 50-100 psi of non-aviation industrial applications.

Illustration of Air Separation Module of FRM System (Left) / Photo of Research Fuel Tank Inserting System, Developed by FAA, as Installed on 747SP Test Airplane (Right)

In July 2008, the FAA issued a rule titled: Reduction of Fuel Tank Flammability in Transport Category Airplanes, which requires measures to assess, and if required, reduce the flammability exposure of certain transport airplane fuel tanks. The complete regulatory docket, including all affected regulatory sections and preamble material, can be found at the following link: (FRM rule)

Back to top

The FAA has issued more than 150 Airworthiness Directives, and continues to issue multiple ADs, on multiple models. The number of ADs, including unsafe conditions found after implementation of SFAR 88, helped convince the FAA that a fuel tank safety strategy of preventing ignition sources alone was not adequate, underscoring the need for a balanced approach toward fuel tank safety.

To view many of the ADs resulting from the TWA 800 accident, access the FAA's Regulatory and Guidance Library (RGL) available via the FAA's Home Page, (http://www.faa.gov), and performing a keyword search in the Airworthiness Directives portion of RGL, using the keyword "SFAR 88".

Back to top

Airplane Life Cycle:

• Design / Manufacturing
• Maintenance / Repair / Alteration

Accident Threat Categories:

• Fuel Tank Ignition

Groupings:

• N/A

Accident Common Themes:

• Flawed Assumptions
• Pre-existing Failures

Back to top

Flawed Assumptions

It was assumed by the aviation community that fuel tank explosions could be precluded by eliminating and/or preventing ignition sources within the fuel tank. There was a regulatory history, culminating in SFAR 88, which prescribed ignition prevention and elimination of ignition sources. TWA 800 and its precursor accidents provided the basis for aggressive ignition prevention actions. While elimination/prevention of ignition sources is still a requirement, the adoption of requirements to reduce the flammability of certain types of fuel tanks has provided an additional means to reduce the risk of fuel tank explosions.

Preexisting Failures

The NTSB determined that the most likely cause of the center wing tank explosion was a short circuit in a wire bundle outside the tank that allowed high voltage into the fuel quantity indicating system components. These failures were latent for an undetermined time - as long as no electrical arcs occurred, ignition of fuel vapors was unlikely. Age-related deterioration of fuel quantity indicating system components provided sources for arcing, which ultimately led to the ignition of heated vapors in the tank.

Back to top

Pan Am 707

December 8, 1963 - Pan Am 707 near Elkton, Maryland. In-flight lightning strike ignited reserve fuel tank, leading to loss of the airplane and all onboard.

Iranian Air Force 747

May 9, 1976 - Iranian Air Force 747, near Madrid, Spain. In-flight lightning strike ignited the reserve fuel tank leading to a loss of the airplane and all onboard.

Philippine Airlines 737

May 11, 1990 - Philippine Airlines 737-300 center tank explosion, while the airplane was on the ground at Manila, Philippines. Flammable vapors in the center tank exploded while the airplane was being pushed back before flight. There were eight fatalities and 30 injuries. No ignition source was able to be identified by the investigation.

Thai Airways 737

March 3, 2001 - Thai Airways 737-400. While parked at the gate in Bangkok, Thailand, the empty center wing tank exploded, killing one flight attendant. No ignition source was able to be identified by the investigation.

Back to top

Technical Related Lessons:

For some types of fuel tank installations, sole reliance on ignition prevention, in order to prevent fuel tank explosion, has proven to be inadequate. (Threat Category: Fuel Tank Ignition)

• During the course of the investigation of TWA 800, it was learned that certain tank configurations are far more vulnerable to ignition risks than others. Tanks such as the center wing tank, that are routinely empty of fuel, and adjacent to heat sources such as air conditioning packs, have been shown to be more vulnerable to explosions hazards. In addition to the TWA 800 accident, two more recent accidents involving empty center tank explosions have underscored this vulnerability. As a result, flammability reduction means is being required to be implemented on certain aircraft that incorporate this type of tank installation.

Common Theme Related Lessons:

Design and maintenance programs must take into account the effects of aging or wear, with the objective of preserving safety capability throughout the life of the airplane. (Common Theme: Flawed Assumptions)

• During the course of the TWA 800 investigation, it was learned that nearly all fuel tank components, on nearly all transport airplanes were treated as "on-condition", and had no targeted inspection, maintenance, or overhaul periods prescribed. At the time of the development of the B747, the primary method used within the industry in establishing a component to be "on condition" involved robust testing and analysis to show that there were no possible conditions or failure modes that would result in an ignition source. This safety attribute, commonly referred to as "explosion proof", was a result of qualitative and quantitative assessments, and relied on a thorough understanding of the failure modes that would be experienced throughout the life of the component. However, it was learned during the investigation of TWA 800 that certain components with explosion proof capability, which were found acceptable when new, often showed degraded performance after many years of service. For example, it was learned that certain new fuel quantity indicating system (FQIS) probes, on some model aircraft, which were found free of arcing at 2000 volts during qualification testing, were discovered to arc at as low as 50 volts after having been in service for more than 30 years involving long exposures to jet fuel contaminants.

Back to top